Jenkins Dotci vulnerabilities

3 CVEs affecting Jenkins Dotci, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-41239, published 2022-09-21.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-41237, published 2022-09-21. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
• CVE-2022-41238, published 2022-09-21. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for…
• CVE-2022-41239, published 2022-09-21. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site…