Publish Advisories

GHSA-6r5w-jjr5-qvgr
GHSA-7ccg-jm7j-4f8v
GHSA-9qv8-7jfq-73j2
GHSA-q5cj-xf99-79m8
GHSA-wjr6-v4c7-8cv6

advisories/github-reviewed/2023/12/GHSA-6r5w-jjr5-qvgr/GHSA-6r5w-jjr5-qvgr.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6r5w-jjr5-qvgr",
-  "modified": "2023-12-13T19:34:24Z",
+  "modified": "2023-12-18T18:39:10Z",
   "published": "2023-12-13T18:31:04Z",
   "aliases": [
     "CVE-2023-50770"
@@ -9,7 +9,10 @@
   "summary": "Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin ",
   "details": "Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
     {
@@ -48,7 +51,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-312"
+      "CWE-312",
+      "CWE-522"
     ],
     "severity": "MODERATE",
     "github_reviewed": true,

advisories/github-reviewed/2023/12/GHSA-7ccg-jm7j-4f8v/GHSA-7ccg-jm7j-4f8v.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7ccg-jm7j-4f8v",
-  "modified": "2023-12-13T19:32:28Z",
+  "modified": "2023-12-18T18:39:20Z",
   "published": "2023-12-13T18:31:04Z",
   "aliases": [
     "CVE-2023-50774"
@@ -9,7 +9,10 @@
   "summary": "Cross-site request forgery vulnerability in Jenkins HTMLResource Plugin",
   "details": "A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files on the Jenkins controller file system.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
+    }
   ],
   "affected": [
     {

advisories/github-reviewed/2023/12/GHSA-9qv8-7jfq-73j2/GHSA-9qv8-7jfq-73j2.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9qv8-7jfq-73j2",
-  "modified": "2023-12-13T23:14:25Z",
+  "modified": "2023-12-18T18:39:15Z",
   "published": "2023-12-13T18:31:04Z",
   "aliases": [
     "CVE-2023-50771"
@@ -9,7 +9,10 @@
   "summary": "Open redirect vulnerability in Jenkins OpenId Connect Authentication Plugin ",
   "details": "Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
     {

advisories/github-reviewed/2023/12/GHSA-q5cj-xf99-79m8/GHSA-q5cj-xf99-79m8.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-q5cj-xf99-79m8",
-  "modified": "2023-12-13T19:44:18Z",
+  "modified": "2023-12-18T18:39:29Z",
   "published": "2023-12-13T18:31:04Z",
   "aliases": [
     "CVE-2023-50773"
@@ -9,7 +9,10 @@
   "summary": "Displayed in plain text by Dingding JSON Pusher Plugin ",
   "details": "Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
   ],
   "affected": [
     {
@@ -48,7 +51,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-200"
+      "CWE-200",
+      "CWE-312"
     ],
     "severity": "MODERATE",
     "github_reviewed": true,

advisories/github-reviewed/2023/12/GHSA-wjr6-v4c7-8cv6/GHSA-wjr6-v4c7-8cv6.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wjr6-v4c7-8cv6",
-  "modified": "2023-12-13T19:34:44Z",
+  "modified": "2023-12-18T18:39:24Z",
   "published": "2023-12-13T18:31:04Z",
   "aliases": [
     "CVE-2023-50772"
@@ -9,7 +9,10 @@
   "summary": "Tokens stored in plain text by Dingding JSON Pusher Plugin ",
   "details": "Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
   ],
   "affected": [
     {