Jenkins Deployer Framework vulnerabilities

4 CVEs affecting Jenkins Deployer Framework, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-36891, published 2022-07-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-36889, published 2022-07-27. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure…
CVE-2022-36890, published 2022-07-27. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for…
CVE-2020-2227, published 2020-07-15. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerability.
CVE-2022-36891, published 2022-07-27. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but without Deploy Now/Deploy permission to read deployment…