jenkins ssh vulnerabilities

Latest jenkins ssh CVEs

Newest publication first

1. CVE-2022-30959 Missing Authorization in Jenkins SSH plugin

   Published 2022-05-17

   Medium·CVSS 6.5 EPSS 0.90%

   A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

2. CVE-2022-30958 Cross Site Request Forgery in Jenkins SSH Plugin

   Published 2022-05-17

   High·CVSS 8.8 EPSS 0.68%

   A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

3. CVE-2022-30957 Missing permission check in Jenkins SSH Plugin

   Published 2022-05-17

   Medium·CVSS 4.3 EPSS 0.75%

   A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

4. CVE-2017-1000245 Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext

   Published 2017-11-01

   Critical·CVSS 9.8 EPSS 1.4%

   The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.