Jenkins Project Jenkins Websphere Deployer Plugin vulnerabilities
5 vulnerabilities
Known vulnerabilities in Jenkins Project Jenkins Websphere Deployer Plugin, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-2108jenkins projectjenkins websphere deployer plugin+2
EPSS score0.90%
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a user with Job/Configure permissions.CVE-2019-16559jenkins projectjenkins websphere deployer plugin+2EPSS score0.68%
A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.CVE-2019-16561jenkins projectjenkins websphere deployer plugin+2EPSS score0.51%
Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM.CVE-2019-16560jenkins projectjenkins websphere deployer plugin+2EPSS score0.69%
A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.CVE-2019-1003056jenkins projectjenkins websphere deployer plugin+1EPSS score1.34%
Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.