Jenkins Xebialabs Xl Deploy vulnerabilities

6 CVEs affecting Jenkins Xebialabs Xl Deploy, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-21665, published 2021-06-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10305, published 2019-04-18. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a…
CVE-2021-21663, published 2021-06-10. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified…
CVE-2021-21664, published 2021-06-10. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified…
CVE-2021-21662, published 2021-06-10. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
CVE-2019-10304, published 2019-04-18. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers to initiate a connection to an…
CVE-2021-21665, published 2021-06-10. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified…