Jenkins Extended Choice Parameter vulnerabilities

5 CVEs affecting Jenkins Extended Choice Parameter, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-29038, published 2022-04-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-27203, published 2022-03-15. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins…
CVE-2022-27205, published 2022-03-15. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2022-29038, published 2022-04-12. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views displaying parameters, resulting in a stored…
CVE-2022-27202, published 2022-03-15. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a…
CVE-2022-27204, published 2022-03-15. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to connect to an attacker-specified URL.