org.jenkins-ci.plugins/assembla vulnerabilities

Latest org.jenkins-ci.plugins/assembla CVEs

Newest publication first

1. CVE-2026-57304 Jenkins Assembla Plugin has a missing permission check

   Published 2026-06-24

   Medium·CVSS 5.4 EPSS 0.25%

   A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.

2. CVE-2026-57305 Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability

   Published 2026-06-24

   Medium·CVSS 5.4 EPSS 0.22%

   A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password.

3. CVE-2026-57303 Jenkins Assembla Plugin has an XXE vulnerability

   Published 2026-06-24

   High·CVSS 7.1 EPSS 0.36%

   Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request...

4. CVE-2019-10420 Jenkins Assembla Plugin has Insufficiently Protected Credentials

   Published 2019-09-25

   Medium·CVSS 5.5 EPSS 0.35%

   Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.