Jenkins Maven vulnerabilities

4 vulnerabilities

Known vulnerabilities in Jenkins Maven, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.9CVE-2017-1000397jenkinsmaven+1
EPSS score
0.49%
Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient.8.8CVE-2019-16550jenkins projectjenkins maven release plugin+2
EPSS score
0.64%
A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents.8.1CVE-2019-16549jenkins projectjenkins maven release plugin+2
EPSS score
0.97%
Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents.6.5CVE-2019-10358jenkins projectjenkins maven integration plugin+2
EPSS score
1.01%
Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.