Cross-Site Request Forgery in Jenkins Deployment Dashboard Plugin

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-34797 · ADVISORY
• jenkinsci/ec2-deployment-dashboard · PACKAGE
• jenkins.io/security/advisory/2022-06-30 · WEB
• jenkins.io/security/advisory/2022-06-30 · Vendor Advisory

Mais vulnerabilidades de org.jenkins-ci.plugins:ec2-deployment-dashboard

• CVE-2023-50775MÉDIO 4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs.
• CVE-2022-34799MÉDIO 4.3Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins control…
• CVE-2022-34798MÉDIO 4.3Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers wit…
• CVE-2022-34796MÉDIO 4.3A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumer…
• CVE-2022-34795MÉDIO 5.4Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a st…