Jenkins Build-Metrics vulnerabilities

3 CVEs affecting Jenkins Build-Metrics, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-34785, published 2022-06-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10475, published 2019-10-23. Medium severity, CVSS 6.1. EPSS: 57.7% chance of exploitation in the next 30 days. A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
CVE-2022-34784, published 2022-06-30. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update…
CVE-2022-34785, published 2022-06-30. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise…