jenkins parameterized trigger vulnerabilities

Latest jenkins parameterized trigger CVEs

Newest publication first

1. CVE-2022-27195 Sensitive parameter values captured in build metadata files by Jenkins Parameterized Trigger Plugin

   Published 2022-03-15

   Medium·CVSS 5.5 EPSS 0.38%

   Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their build.xml files. These values are stored unencrypted and can be viewed by user...

2. CVE-2017-1000084 Parameterized Trigger Plugin fails to check Item/Build permission

   Published 2017-10-04

   Medium·CVSS 6.5 EPSS 0.78%

   Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.