Jenkins iceScrum Plugin vulnerable to stored Cross-site Scripting

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-28160 · ADVISORY
• jenkinsci/icescrum-plugin · PACKAGE
• jenkins.io/security/advisory/2024-03-06 · WEB
• openwall.com/lists/oss-security/2024/03/06/3 · WEB

org.jenkins-ci.plugins:icescrum のその他の脆弱性

• CVE-2019-10443高 8.8Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be v…
• CVE-2019-10442中 4.3A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an atta…
• CVE-2019-10441中 4.3A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specifie…