Jenkins Lucene-Search vulnerabilities
3 known vulnerabilities affecting jenkins/lucene-search.
Total CVEs
3
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
MEDIUM3
Vulnerabilities
Page 1 of 1
CVE-2023-30529MEDIUMCVSS 4.3≤ 387.v938a_ecb_f7fe92023-04-12
CVE-2023-30529 [MEDIUM] CWE-352 CVE-2023-30529: Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an H
Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database.
nvd
CVE-2022-36922MEDIUMCVSS 6.1≤ 370.v62a5f618cd3a2022-07-27
CVE-2022-36922 [MEDIUM] CWE-79 CVE-2022-36922: Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query paramete
Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting (XSS) vulnerability.
nvd
CVE-2022-36910MEDIUMCVSS 5.4≤ 370.v62a5f618cd3a2022-07-27
CVE-2022-36910 [MEDIUM] CWE-862 CVE-2022-36910: Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in se
Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them.
nvd