Jenkins Subversion vulnerabilities

7 CVEs affecting Jenkins Subversion, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-29048, published 2022-04-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-29046, published 2022-04-12. Medium severity, CVSS 5.4. EPSS: 2.5% chance of exploitation in the next 30 days. Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site…
CVE-2021-21698, published 2021-11-04. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.
CVE-2022-29048, published 2022-04-12. Medium severity, CVSS 4.3. EPSS: 1.9% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL.
CVE-2020-2304, published 2020-11-04. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2017-1000085, published 2017-10-05. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user…
CVE-2020-2111, published 2020-02-12. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability.
CVE-2018-1000111, published 2018-03-13. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus.java that allows an attacker with…