Jenkins Quay.io Trigger vulnerabilities

2 CVEs affecting Jenkins Quay.io Trigger, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-30520, published 2023-04-12.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-30520, published 2023-04-12. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting (XSS)…
• CVE-2023-30519, published 2023-04-12. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.