Threats tagged 'maven'

The Jenkins Start Windocks Containers Plugin version 1.4 and earlier lacks proper permission checks on an HTTP endpoint. This flaw allows users with Overall/Read permission to connect to arbitrary URLs specified by an attacker. Additionally, the endpoint does not require POST requests, enabling a cross-site request forgery (CSRF) vulnerability. No fix is currently available for this issue.

Jenkins OpenShift Pipeline Plugin versions 1.0.57 and earlier store authorization tokens unencrypted in job config.xml files on the Jenkins controller. These tokens can be accessed by users with Item/Extended Read permission or by anyone with access to the Jenkins controller file system. No fix is currently available for this vulnerability.

The Jenkins Azure CLI Plugin version 0.9 and earlier allows users with Item/Configure permission to execute arbitrary shell commands on the Jenkins controller due to lack of command execution restrictions. This vulnerability is identified as CVE-2025-64140 and has a high severity score of 8.8. No fix is currently available for this issue.

The Jenkins Nexus Task Runner Plugin version 0.9.2 and earlier contains a vulnerability where an HTTP endpoint does not perform proper permission checks and does not require POST requests. This results in a cross-site request forgery (CSRF) vulnerability that allows attackers with Overall/Read permission to connect to attacker-specified URLs using attacker-specified credentials. No fix is currently available for this issue.

Jenkins Nexus Task Runner Plugin versions 0.9.2 and earlier lack a permission check on an HTTP endpoint, allowing users with Overall/Read permission to connect to arbitrary URLs with attacker-specified credentials. The endpoint also does not require POST requests, enabling a cross-site request forgery (CSRF) vulnerability. No fix is currently available.

Jenkins Themis Plugin versions 1.4.1 and earlier lack a permission check on an HTTP endpoint, allowing attackers with Overall/Read permission to connect to arbitrary URLs. The endpoint also does not require POST requests, introducing a cross-site request forgery (CSRF) vulnerability. No fix is currently available for this issue.

The Jenkins JDepend Plugin version 1.3.1 and earlier contains an XML external entity (XXE) vulnerability due to an outdated JDepend Maven Plugin that does not properly configure its XML parser. This flaw allows attackers who can control input files for the 'Report JDepend' step to craft malicious XML that can lead to extraction of secrets from the Jenkins controller or enable server-side request forgery. No fix is currently available for this vulnerability.

The Jenkins Eggplant Runner Plugin versions 0.0.1.301.v963cffe8ddb and earlier disable a Java runtime protection mechanism by setting the system property 'jdk.http.auth.tunneling.disabledSchemes' to an empty value during proxy configuration. This action disables a security feature that addresses CVE-2016-5597. No fix is currently available for this vulnerability.

Jenkins Themis Plugin versions 1.4.1 and earlier contain a cross-site request forgery (CSRF) vulnerability due to a missing permission check on an HTTP endpoint and the lack of requirement for POST requests. This flaw allows attackers with Overall/Read permission to connect to attacker-specified URLs without proper authorization checks. No fix is currently available for this vulnerability.

The Jenkins Start Windocks Containers Plugin version 1.4 and earlier has a vulnerability where it does not perform permission checks on an HTTP endpoint. This flaw allows attackers with Overall/Read permission to connect to arbitrary URLs specified by the attacker. Additionally, the endpoint is vulnerable to cross-site request forgery (CSRF) because it does not require POST requests. No fix is currently available for this vulnerability.

Jenkins MCP Server Plugin versions 0.84.v50ca_24ef83f2 and earlier lack proper permission checks in several MCP tools. This flaw allows attackers with limited permissions to access or trigger actions they should not be authorized for, such as obtaining SCM configuration details, triggering builds, or retrieving cloud names without sufficient privileges. The issue is fixed in version 0.86.v7d3355e6a.

The Jenkins Extensible Choice Parameter Plugin version 239.v5f5c278708cf and earlier contains a cross-site request forgery (CSRF) vulnerability due to not requiring POST requests for an HTTP endpoint. This flaw allows attackers to execute sandboxed Groovy code. No fix is currently available for this vulnerability.

Jenkins SAML Plugin versions up to 4.583.vc68232f7018a_ do not implement a replay cache, allowing attackers who can observe SAML authentication requests to replay them and authenticate as the targeted user. The vulnerability is fixed in version 4.583.585.v22ccc1139f55, which adds a replay cache to reject replayed requests.

Apache Syncope Core versions prior to 3.0.14 and between 4.0.0-M0 and before 4.0.2 allow malicious administrators to inject Groovy code that can be executed remotely. This vulnerability arises from the feature that allows runtime reload of custom Groovy implementations, which was not properly sandboxed. The issue is fixed in versions 3.0.14 and 4.0.2 by enforcing sandboxing of Groovy code execution.

Apache Geode versions 1.10.0 through 1.15.1 are vulnerable to Cross-Site Request Forgery (CSRF) attacks via GET requests to the Management and Monitoring REST API. An attacker who tricks a user into exposing their Geode session credentials could submit malicious commands on behalf of the authenticated user. The issue is fixed in version 1.15.2.

Apache Geode web-api versions prior to 1.15.2 contain a Cross-site Scripting (XSS) vulnerability (CVE-2024-44088). This flaw allows attackers to inject malicious scripts that execute in the context of a logged-in user's browser when they click a crafted link. Successful exploitation can lead to theft of session information and potential account takeover. The vulnerability is fixed in version 1.15.2.

Apache StreamPark versions from 2.1.4 up to 2.1.5 contain an Incorrect Execution-Assigned Permissions vulnerability. This flaw allows unauthorized permission assignments during execution, potentially leading to confidentiality, integrity, and availability impacts. The issue is fixed in version 2.1.6, which is not yet published in the Maven registry.

Apache Flink CDC versions 3.0.0 through 3.4.x are vulnerable to SQL injection via maliciously crafted identifiers such as database or table names. This vulnerability requires the attacker to have logged-in database user privileges to trigger the issue. The vulnerability is addressed in version 3.5.0.

Apache Kylin versions from 4.0.0 up to 5.0.2 contain a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows an attacker to induce the server to make unintended requests, potentially leading to information disclosure and impact on confidentiality, integrity, and availability. The vulnerability is fixed in version 5.0.3. Users are advised to upgrade to this version to mitigate the risk.

Apache Kylin versions from 4.0.0 up to 5.0.2 have a vulnerability that allows files or directories to be accessible to external parties. This issue can expose sensitive data if administrative access controls are not properly enforced. The vulnerability is fixed in version 5.0.3.