Jenkins Role-Based Authorization Strategy vulnerabilities

4 CVEs affecting Jenkins Role-Based Authorization Strategy, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-28668, published 2023-04-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-2286, published 2020-10-08. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is changed, resulting in permissions being granted based on an…
CVE-2021-21624, published 2021-03-18. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read permission on nested items to access them, even if they lack…
CVE-2023-28668, published 2023-04-02. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.
CVE-2017-1000090, published 2017-10-05. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add…