4.2
Medium
CVE-2023-4302 A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission…
Description
A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Fortify Plugin 22.1 | earliest → 22.1.38 | No fix stated |
Other CVEs of Jenkins Fortify Plugin
The 5 CVEs of Jenkins Fortify Plugin →
CVE-2023-4301
A cross-site request forgery (CSRF) vulnerability in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers to…
4.2
Medium
CVE-2023-4303
Jenkins Fortify Plugin 22.1.38 and earlier does not escape the error message for a form validation method, resulting…
4.3
Medium
CVE-2022-25188
Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline…
Not rated
CVE-2020-2107
Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the…
Not rated