Jenkins Cloudbees Cd vulnerabilities

3 vulnerabilities

Known vulnerabilities in Jenkins Cloudbees Cd, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.3CVE-2021-21647jenkins projectjenkins cloudbees cd plugin+2
EPSS score
1.46%
Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having Item/Build permission.8.1CVE-2023-46654jenkins projectjenkins cloudbees cd plugin+2
EPSS score
1.35%
Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to delete arbitrary files on the Jenkins controller file system.6.5CVE-2023-46655jenkins projectjenkins cloudbees cd plugin+2
EPSS score
1.16%
Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to publish arbitrary files from the Jenkins controller file system to the previously configured CloudBees CD server.