Jenkins Warnings vulnerabilities

4 CVEs affecting Jenkins Warnings, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-46651, published 2023-10-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-1003007, published 2019-02-06. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that allows attackers to execute arbitrary…
CVE-2020-2280, published 2020-09-23. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code.
CVE-2018-1000012, published 2018-01-23. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from…
CVE-2023-46651, published 2023-10-25. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are…