Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca and earlier does not perform a permission check in an HTTP endpoint that populates the list of values for Git parameters by querying the SCM configured on a job, using the SCM credentials configured in Jenkins. This allows attackers with Item/Read permission to obtain information about the SCM repository used by a job they would otherwise be unable to access, such as branch names, tag names, and revision metadata. Git Parameter Plugin 462.463.v496a59f698e5 requires Item/Build permission to populate the list of values for Git parameters.
Recommended action: Upgrade to 462.463 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Git Parameter Plugin implements a choice build parameter that lists the configured Git SCM’s branches, tags, pull requests, and revisions. Git Parameter Plugin 439.vb0e46ca14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices. This allows attackers with Item/Build permission to inject arbitrary values into Git parameters. Git Parameter Plugin 444.vcab84d3703c2 validates that the Git parameter value submitted to the build matches one of the offered choices.
Recommended action: Upgrade to 444.vca or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Git Parameter Plugin 0.9.13 escapes the repository field on the 'Build with Parameters' page.
Recommended action: Upgrade to 0.9.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
Recommended action: Upgrade to 0.9.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
Recommended action: Upgrade to 0.9.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Recommended action: Upgrade to 0.9.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.