CVE-2022-30954

CVE-2022-30954: vulnerability in Jenkins Blue Ocean Plugin

Published · Updated

Follow this CVE+ Monitor Jenkins Blue Ocean Plugin+ Monitor io.jenkins.blueocean:blueocean-parent

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.9%
Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
Affected products
Jenkins project · Jenkins Blue Ocean Plugin
Related CVEs — Jenkins Blue Ocean Plugin

In the same product, most dangerous first.

CVE-2020-2254—CVE-2020-2254EPSS 2.1%CVE-2020-2255—CVE-2020-2255EPSS 0.9%CVE-2022-30953—CVE-2022-30953EPSS 0.7%