Jenkins Findbugs vulnerabilities

2 CVEs affecting Jenkins Findbugs, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-2317, published 2020-11-04.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-1000011, published 2018-01-23. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from…
• CVE-2020-2317, published 2020-11-04. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide…