Vulnerabilities > Jenkins > Critical

DATE CVE VULNERABILITY TITLE RISK
2024-01-24 CVE-2024-23897 Path Traversal vulnerability in Jenkins
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
network
low complexity
jenkins CWE-22
critical
9.8
2023-11-29 CVE-2023-49654 Missing Authorization vulnerability in Jenkins Matlab
Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system.
network
low complexity
jenkins CWE-862
critical
9.8
2023-11-29 CVE-2023-49656 XXE vulnerability in Jenkins Matlab
Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
network
low complexity
jenkins CWE-611
critical
9.8
2023-03-10 CVE-2023-27898 Cross-site Scripting vulnerability in Jenkins
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
network
low complexity
jenkins CWE-79
critical
9.6
2023-03-10 CVE-2023-27905 Cross-site Scripting vulnerability in Jenkins Update-Center2 3.13/3.14
Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.
network
low complexity
jenkins CWE-79
critical
9.6
2023-02-15 CVE-2023-25765 Unspecified vulnerability in Jenkins Email Extension
In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
network
low complexity
jenkins
critical
9.9
2023-01-26 CVE-2023-24427 Session Fixation vulnerability in Jenkins Bitbucket Oauth
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.
network
low complexity
jenkins CWE-384
critical
9.8
2023-01-26 CVE-2023-24429 XXE vulnerability in Jenkins Semantic Versioning
Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
network
low complexity
jenkins CWE-611
critical
9.8
2023-01-26 CVE-2023-24430 XXE vulnerability in Jenkins Semantic Versioning
Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
network
low complexity
jenkins CWE-611
critical
9.8
2023-01-26 CVE-2023-24441 XXE vulnerability in Jenkins Mstest
Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
network
low complexity
jenkins CWE-611
critical
9.8