com.xebialabs.deployit.ci/deployit-plugin vulnerabilities

Latest com.xebialabs.deployit.ci/deployit-plugin CVEs

Newest publication first

1. CVE-2021-21665 CSRF vulnerability in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials

   Published 2021-06-10

   High·CVSS 8.8 EPSS 0.66%

   A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials st...

2. CVE-2021-21664 Incorrect permission check in XebiaLabs XL Deploy Plugin allows capturing credentials

   Published 2021-06-10

   Medium·CVSS 6.5 EPSS 0.99%

   An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password cre...

3. CVE-2021-21663 Missing permission check in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials

   Published 2021-06-10

   Medium·CVSS 4.3 EPSS 1.0%

   A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentia...

4. CVE-2021-21662 Missing permission check in Jenkins XebiaLabs XL Deploy Plugin allows enumerating credentials IDs

   Published 2021-06-10

   Medium·CVSS 4.3 EPSS 0.95%

   A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.

5. CVE-2019-10305 Missing permission check in Jenkins XebiaLabs XL Deploy Plugin

   Published 2019-04-18

   Medium·CVSS 6.5 EPSS 1.0%

   A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

6. CVE-2019-10304 Jenkins XebiaLabs XL Deploy Plugin vulnerable to Cross-site request forgery (CSRF)

   Published 2019-04-18

   Medium·CVSS 6.5 EPSS 0.89%

   A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers to initiate a connection to an attacker-specified server.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.