Jenkins Cloudbees Cd vulnerabilities

3 CVEs affecting Jenkins Cloudbees Cd, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-46655, published 2023-10-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-21647, published 2021-04-21. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read permission to schedule builds of projects without having…
CVE-2023-46654, published 2023-10-25. High severity, CVSS 8.1. EPSS: 1.4% chance of exploitation in the next 30 days. Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build…
CVE-2023-46655, published 2023-10-25. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'CloudBees CD - Publish Artifact' post-build…