Jenkins Self-Organizing Swarm Modules vulnerabilities

3 CVEs affecting Jenkins Self-Organizing Swarm Modules, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-2192, published 2020-06-03.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-10309, published 2019-04-30. Critical severity, CVSS 9.3. EPSS: 1.8% chance of exploitation in the next 30 days. Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML External Entity processing when processing the responses, allowing…
• CVE-2020-2191, published 2020-06-03. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier does not check permissions on API endpoints that allow adding and removing agent labels.
• CVE-2020-2192, published 2020-06-03. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A cross-site request forgery vulnerability in Jenkins Self-Organizing Swarm Plug-in Modules Plugin 3.20 and earlier allows attackers to add or remove agent labels.