Homepage
About Snyk

com.coravy.hudson.plugins.github:github@0.2 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the com.coravy.hudson.plugins.github:github package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

com.coravy.hudson.plugins.github:github is a Jenkins GitHub plugin

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper escaping of GitHub project URL. An attacker with Item/Configure permission can inject malicious scripts in the user's browser by manipulating the URL.

How to fix Cross-site Scripting (XSS)?

Upgrade com.coravy.hudson.plugins.github:github to version 1.37.3.1 or higher.

[,1.37.3.1)
  • M
Timing Attack

com.coravy.hudson.plugins.github:github is a Jenkins GitHub plugin

Affected versions of this package are vulnerable to Timing Attack when it uses a non-constant time comparison function to check whether the provided and computed webhook signatures are equal, it allows attackers to use statistical methods to obtain a valid webhook signature.

How to fix Timing Attack?

A fix was pushed into the master branch but not yet published.

[0,)
  • H
Information Exposure

com.coravy.hudson.plugins.github:github integrates Jenkins with Github projects.

Affected versions of this package are vulnerable to Information Exposure via the GitHubTokenCredentialsCreator.java method. A malicious user with Overall/Read access, could connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

How to fix Information Exposure?

Upgrade com.coravy.hudson.plugins.github:github to version 1.29.2 or higher.

[,1.29.2)
  • M
Server-Side Request Forgery (SSRF)

com.coravy.hudson.plugins.github:github is a Jenkins GitHub plugin.

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF). An attacker with Overall/Read access could cause Jenkins to send a GET request to a specified URL.

How to fix Server-Side Request Forgery (SSRF)?

Upgrade com.coravy.hudson.plugins.github:github to version 1.29.1 or higher.

[,1.29.1)
  • M
Information Exposure

com.coravy.hudson.plugins.github:github is a Jenkins GitHub plugin.

Affected versions of this package are vulnerable to Information Exposure. A malicious user Overall/Read access could connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

How to fix Information Exposure?

Upgrade com.coravy.hudson.plugins.github:github to version 1.29.1 or higher.

[,1.29.1)
Go back to all versions of this package