Jenkins Release vulnerabilities

2 CVEs affecting Jenkins Release, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-2292, published 2020-10-08.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-1000013, published 2018-01-23. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to trigger release builds.
• CVE-2020-2292, published 2020-10-08. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with…