Jenkins Project Inheritance Plugin vulnerable to Cross-Site Request Forgery

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-10408 · ADVISORY
• jenkins.io/security/advisory/2019-09-25 · WEB
• openwall.com/lists/oss-security/2019/09/25/3 · WEB

hudson.plugins:project-inheritance のその他の脆弱性

• CVE-2022-34787中 5.4Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site…
• CVE-2020-2198中 6.5Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting …
• CVE-2020-2197中 4.3Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance Pro…
• CVE-2019-10409中 4.3A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger…
• CVE-2019-10407中 6.5Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive v…