Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.jenkins.plugins:embotics-vcommander

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.4MavenPublished

    Jenkins Snow Commander Plugin prior to 2.0 vulnerable to Missing Authorization

    CVE-2022-25193 · GHSA-2phq-ghf8-6586

    Affected
    • Maven io.jenkins.plugins:embotics-vcommander < 2.0
    Fixed in
    2.0· Vendor fix available
    Issue
    Snow Commander Plugin 1.10 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

    Recommended action: Upgrade to 2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →