netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-38pm-74xc-phcw
GHSA-p674-hh8x-rv5h
This commit is contained in:
advisory-database[bot]
2023-10-27 15:02:21 +00:00
parent f7ac604e3d
commit 2ba06e1aa9
2 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-38pm-74xc-phcw/GHSA-38pm-74xc-phcw.json
+3 -3
View File
@@ -1,17 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-38pm-74xc-phcw",
"modified": "2022-12-14T16:12:42Z",
"modified": "2023-10-27T15:01:52Z",
"published": "2022-05-24T19:04:53Z",
"aliases": [
"CVE-2021-21665"
],
"summary": "CSRF vulnerability in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials",
"details": "A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.\n\nXebiaLabs XL Deploy Plugin 10.0.2 requires POST requests and Overall/Administer permission for the affected form validation method.",
"details": "A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.\n\nJenkins XebiaLabs XL Deploy Plugin 10.0.2 requires POST requests and Overall/Administer permission for the affected form validation method.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
advisories/github-reviewed/2022/05/GHSA-p674-hh8x-rv5h/GHSA-p674-hh8x-rv5h.json
+12 -4
View File
@@ -1,17 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p674-hh8x-rv5h",
"modified": "2022-12-14T21:43:16Z",
"modified": "2023-10-27T15:00:45Z",
"published": "2022-05-24T19:03:11Z",
"aliases": [
"CVE-2021-21658"
],
"summary": "XML external entity vulnerability in Jenkins Nuget Plugin",
"details": "Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This XML parser is used for the \\\"Build on NuGet updates\\\" feature.\n\nThis allows attackers with the ability to control the contents of the `packages.config` file in a workspace to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nNuget Plugin 1.1 disables external entity resolution for its XML parser.",
"details": "Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This XML parser is used for the \\\"Build on NuGet updates\\\" feature.\n\nThis allows attackers with the ability to control the contents of the `packages.config` file in a workspace to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.\n\nJenkins Nuget Plugin 1.1 disables external entity resolution for its XML parser.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N"
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -40,6 +40,14 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21658"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/nuget-plugin/commit/542bf38ac52f045741a5670e1644af351878f7e0"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/nuget-plugin/commit/c8ed4cb5b1c42f3c407f9f418b4e0b4274bea5a9"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/nuget-plugin"
@@ -57,7 +65,7 @@
"cwe_ids": [
"CWE-611"
],
"severity": "MODERATE",
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2022-09-07T23:54:54Z",
"nvd_published_at": "2021-05-25T17:15:00Z"