Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. Warnings Plugin 10.5.1 defines the appropriate context for credentials lookup. This fix has been backported to 10.4.1.
Recommended action: Upgrade to 10.5.1 or 10.4.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds.
Recommended action: Upgrade to 5.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages.
Recommended action: Upgrade to 5.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Warnings Next Generation Plugin 8.4.4 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents. Jenkins Warnings Next Generation Plugin 8.5.0 requires Item/Configure permission to validate patterns with workspace contents.
Recommended action: Upgrade to 8.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML.
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Warnings Next Generation Plugin prior to 9.10.3, 9.7.1, 9.5.2, and 9.0.2 does not restrict the name of a file when configuring a custom ID. This allows attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system. Jenkins Warnings Next Generation Plugin 9.10.3, 9.7.1, 9.5.2, and 9.0.2 checks for the presence of prohibited directory separator characters in the custom ID.
Recommended action: Upgrade to 9.10.3, 9.7.1, 9.5.2 or 9.0.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.