Jenkins Global-Build-Stats vulnerabilities

2 CVEs affecting Jenkins Global-Build-Stats, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-27207, published 2022-03-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-1000389, published 2018-01-26. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could…
CVE-2022-27207, published 2022-03-15. Medium severity, CVSS 4.8. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting (XSS)…