Jenkins Parameterized Trigger vulnerabilities

2 CVEs affecting Jenkins Parameterized Trigger, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-27195, published 2022-03-15.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-1000084, published 2017-10-05. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as and allowed triggering any other project…
• CVE-2022-27195, published 2022-03-15. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in…