Jenkins Pipeline GitHub Notify Step vulnerabilities

3 CVEs affecting Jenkins Pipeline GitHub Notify Step, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-2118, published 2020-02-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-2116, published 2020-02-12. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified…
CVE-2020-2118, published 2020-02-12. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials…
CVE-2020-2117, published 2020-02-12. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using…