Jenkins Project Jenkins Chef Sinatra Plugin vulnerabilities
5 known vulnerabilities affecting jenkins_project/jenkins_chef_sinatra_plugin.
Total CVEs
5
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH3MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2022-25208HIGHCVSS 8.8≥ unspecified, ≤ 1.202022-02-15
CVE-2022-25208 [HIGH] CWE-862 CVE-2022-25208: A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Ove
A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.
cvelistv5nvd
CVE-2022-25207HIGHCVSS 8.8≥ unspecified, ≤ 1.202022-02-15
CVE-2022-25207 [HIGH] CWE-352 CVE-2022-25207: A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier al
A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.
cvelistv5nvd
CVE-2022-25209HIGHCVSS 8.8≥ unspecified, ≤ 1.202022-02-15
CVE-2022-25209 [HIGH] CWE-611 CVE-2022-25209: Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML extern
Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
cvelistv5nvd
CVE-2019-1003086MEDIUMCVSS 6.5vall versions as of 2019-04-032019-04-04
CVE-2019-1003086 [MEDIUM] CWE-352 CVE-2019-1003086: A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfigur
A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
cvelistv5nvd
CVE-2019-1003087MEDIUMCVSS 6.5vall versions as of 2019-04-032019-04-04
CVE-2019-1003087 [MEDIUM] CWE-862 CVE-2019-1003087: A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.Descriptor
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
cvelistv5nvd