Jenkins Project Jenkins Pipeline Phoenix Autotest Plugin vulnerabilities

4 known vulnerabilities affecting jenkins_project/jenkins_pipeline_phoenix_autotest_plugin.

Total CVEs

4

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

HIGH1MEDIUM3

Vulnerabilities

Page 1 of 1

CVE-2022-28155HIGHCVSS 8.1≥ unspecified, ≤ 1.32022-03-29

CVE-2022-28155 [HIGH] CWE-611 CVE-2022-28155: Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to preve Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVE-2022-28156MEDIUMCVSS 6.5≥ unspecified, ≤ 1.32022-03-29

CVE-2022-28156 [MEDIUM] CWE-22 CVE-2022-28156: Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permi Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace.

CVE-2022-28157MEDIUMCVSS 6.5≥ unspecified, ≤ 1.32022-03-29

CVE-2022-28157 [MEDIUM] CWE-22 CVE-2022-28157: Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permi Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server.

CVE-2022-28158MEDIUMCVSS 6.5≥ unspecified, ≤ 1.32022-03-29

CVE-2022-28158 [MEDIUM] CWE-862 CVE-2022-28158: A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attac A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.