Vulnerabilities > Jenkins > Deployer Framework

DATE CVE VULNERABILITY TITLE RISK
2022-07-27 CVE-2022-36889 Path Traversal vulnerability in Jenkins Deployer Framework
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
network
low complexity
jenkins CWE-22
8.8
2022-07-27 CVE-2022-36890 Path Traversal vulnerability in Jenkins Deployer Framework
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
network
low complexity
jenkins CWE-22
4.3
2022-07-27 CVE-2022-36891 Missing Authorization vulnerability in Jenkins Deployer Framework
A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with Item/Read permission but without Deploy Now/Deploy permission to read deployment logs.
network
low complexity
jenkins CWE-862
4.3
2020-07-15 CVE-2020-2227 Cross-site Scripting vulnerability in Jenkins Deployer Framework 1.0/1.1/1.2
Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in a stored cross-site scripting vulnerability.
network
low complexity
jenkins CWE-79
5.4