Improper masking of credentials in Jenkins Pipeline Maven Integration Plugin

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-41934 · ADVISORY
• jenkins.io/security/advisory/2023-09-06 · WEB
• openwall.com/lists/oss-security/2023/09/06/9 · WEB

org.jenkins-ci.plugins:pipeline-maven のその他の脆弱性

• CVE-2020-2256中 5.4Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, …
• CVE-2020-2235中 6.5A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect…
• CVE-2020-2234中 6.5A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect t…
• CVE-2020-2233中 6.5A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate…
• CVE-2019-10327高 8.1An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to contro…