Jenkins Websphere Deployer vulnerabilities

4 vulnerabilities

Known vulnerabilities in Jenkins Websphere Deployer, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.6CVE-2020-2108jenkins projectjenkins websphere deployer plugin+2
EPSS score
0.90%
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions.5.5CVE-2019-16559jenkins projectjenkins websphere deployer plugin+2
EPSS score
0.68%
A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.7.1CVE-2019-16561jenkins projectjenkins websphere deployer plugin+2
EPSS score
0.51%
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM.8.8CVE-2019-16560jenkins projectjenkins websphere deployer plugin+2
EPSS score
0.69%
A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.