Cross-site request forgery vulnerability in Jenkins Deployment Dashboard Plugin

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-50775 · ADVISORY
• jenkinsci/ec2-deployment-dashboard · PACKAGE
• jenkins.io/security/advisory/2023-12-13 · WEB
• openwall.com/lists/oss-security/2023/12/13/4 · WEB

org.jenkins-ci.plugins:ec2-deployment-dashboard のその他の脆弱性

• CVE-2022-34799中 4.3Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins control…
• CVE-2022-34798中 4.3Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers wit…
• CVE-2022-34797中 4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to a…
• CVE-2022-34796中 4.3A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumer…
• CVE-2022-34795中 5.4Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a st…