Jenkins Embeddable Build Status vulnerabilities

4 CVEs affecting Jenkins Embeddable Build Status, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-34180, published 2022-06-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-34179, published 2022-06-23. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image style without restricting possible values, resulting…
CVE-2019-10346, published 2019-07-11. Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days. A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.
CVE-2022-34180, published 2022-06-23. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. Jenkins Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access, allowing…
CVE-2022-34178, published 2022-06-23. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site…