Jenkins Pipeline Github Notify Step vulnerabilities
3 known vulnerabilities affecting jenkins/pipeline_github_notify_step.
Total CVEs
3
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2020-2116P3HIGHCVSS 8.8≤ 1.0.42020-02-12
CVE-2020-2116 [HIGH] CWE-352 CVE-2020-2116: A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and e
A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
nvd
CVE-2020-2117P4MEDIUMCVSS 4.3≤ 1.0.42020-02-12
CVE-2020-2117 [MEDIUM] CWE-276 CVE-2020-2117: A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows at
A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
nvd
CVE-2020-2118P4MEDIUMCVSS 4.3≤ 1.0.42020-02-12
CVE-2020-2118 [MEDIUM] CWE-276 CVE-2020-2118: A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-r
A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
nvd