Jenkins Matlab vulnerabilities

4 CVEs affecting Jenkins Matlab, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-49673, published 2023-11-29.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-49656, published 2023-11-29. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
• CVE-2023-49654, published 2023-11-29. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system.
• CVE-2023-49673, published 2023-11-29. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using…
• CVE-2023-49655, published 2023-11-29. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML file from the Jenkins controller file system.