Vulnerabilities > Jenkins > Pipeline Maven Integration

DATE CVE VULNERABILITY TITLE RISK
2023-09-06 CVE-2023-41934 Unspecified vulnerability in Jenkins Pipeline Maven Integration
Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked.
network
low complexity
jenkins
5.3
2020-09-16 CVE-2020-2256 Cross-site Scripting vulnerability in Jenkins Pipeline Maven Integration
Jenkins Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
network
low complexity
jenkins CWE-79
5.4
2020-08-12 CVE-2020-2235 Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration
A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows attackers to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.
network
low complexity
jenkins CWE-352
6.5
2020-08-12 CVE-2020-2234 Missing Authorization vulnerability in Jenkins Pipeline Maven Integration
A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.
network
low complexity
jenkins CWE-862
6.5
2020-08-12 CVE-2020-2233 Incorrect Authorization vulnerability in Jenkins Pipeline Maven Integration
A missing permission check in Jenkins Pipeline Maven Integration Plugin 3.8.2 and earlier allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
network
low complexity
jenkins CWE-863
6.5
2019-05-31 CVE-2019-10327 XXE vulnerability in Jenkins Pipeline Maven Integration
An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks.
network
low complexity
jenkins CWE-611
8.1