Jenkins Failed Job Deactivator vulnerabilities

2 CVEs affecting Jenkins Failed Job Deactivator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-34818, published 2022-06-30.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-34818, published 2022-06-30. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.
• CVE-2022-34817, published 2022-06-30. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs.