Jenkins Pipeline Github Notify Step vulnerabilities

3 vulnerabilities

Known vulnerabilities in Jenkins Pipeline Github Notify Step, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2020-2116jenkins projectjenkins pipeline github notify step plugin+2
EPSS score
0.68%
A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.4.3CVE-2020-2118jenkins projectjenkins pipeline github notify step plugin+2
EPSS score
0.68%
A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.4.3CVE-2020-2117jenkins projectjenkins pipeline github notify step plugin+2
EPSS score
0.68%
A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.