Jenkins Maven Artifact Choicelistprovider (nexus) vulnerabilities

2 CVEs affecting Jenkins Maven Artifact Choicelistprovider (nexus), 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-40347, published 2023-08-16.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-1999030, published 2018-08-01. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java,…
• CVE-2023-40347, published 2023-08-16. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and…