Jenkins Subversion Partial Release Manager vulnerabilities

4 CVEs affecting Jenkins Subversion Partial Release Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-34148, published 2024-05-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-2199, published 2020-06-03. Medium severity, CVSS 6.1. EPSS: 6.2% chance of exploitation in the next 30 days. Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation, resulting in a reflected cross-site scripting…
CVE-2024-34148, published 2024-05-02. Medium severity, CVSS 6.8. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a release tag, by setting the Java system…
CVE-2024-28159, published 2024-03-06. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. A missing permission check in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers with Item/Read permission to trigger a build.
CVE-2024-28158, published 2024-03-06. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers to trigger a build.