Jenkins Electricflow vulnerabilities

6 CVEs affecting Jenkins Electricflow, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-10336, published 2019-06-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10332, published 2019-06-11. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using…
CVE-2019-10336, published 2019-06-11. Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days. A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and…
CVE-2019-10333, published 2019-06-11. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain information about the Jenkins ElectricFlow Plugin…
CVE-2019-10334, published 2019-06-11. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used to upload files.
CVE-2019-10335, published 2019-06-11. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the output of the ElectricFlow API to…
CVE-2019-10331, published 2019-06-11. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attackers to connect to an attacker-specified URL using…