Jenkins Chef Sinatra vulnerabilities

4 vulnerabilities

Known vulnerabilities in Jenkins Chef Sinatra, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2022-25208jenkins projectjenkins chef sinatra plugin+2
EPSS score
1.10%
A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.8.8CVE-2022-25209jenkins projectjenkins chef sinatra plugin+2
EPSS score
1.11%
Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.8.8CVE-2022-25207jenkins projectjenkins chef sinatra plugin+2
EPSS score
0.72%
A cross-site request forgery (CSRF) vulnerability in Jenkins Chef Sinatra Plugin 1.20 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.6.5CVE-2019-1003087jenkins projectjenkins chef sinatra plugin+2
EPSS score
1.51%
A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.