io.jenkins.plugins/folder-auth vulnerabilities

Latest io.jenkins.plugins/folder-auth CVEs

Newest publication first

1. CVE-2025-24401 Disabled permissions can be granted by Folder-based in Jenkins Authorization Strategy Plugin

   Published 2025-01-22

   Medium·CVSS 6.8 EPSS 0.32%

   Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they'...

2. CVE-2022-27200 Stored Cross-site Scripting in folder-auth plugin

   Published 2022-03-15

   Medium·CVSS 4.8 EPSS 0.63%

   Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.