org.jvnet.hudson.plugins:ftppublisher@0.9 vulnerabilities
latest version
1.0
first published
16 years ago
latest version published
14 years ago
licenses detected
- [0.9,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.jvnet.hudson.plugins:ftppublisher package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.jvnet.hudson.plugins:ftppublisher is a Jenkins plugin used to upload project artifacts and whole directories to an ftp server. Affected versions of this package are vulnerable to Cross-Site Request Forgery (CSRF). The form validation method used by the plugin does not require POST requests, and is predictable resulting in a CSRF vulnerability. This vulnerability could be leveraged with CVE-2019-1003059 to trick a user into initiating a connection test to an attacker-specified FTP server with attacker-specified credentials. How to fix Cross-Site Request Forgery (CSRF)? There is no fixed version for | [0,) |
org.jvnet.hudson.plugins:ftppublisher is a Jenkins plugin used to upload project artifacts and whole directories to an ftp server. Affected versions of this package are vulnerable to Insufficiently Protected Credentials. Credentials are stored unencrypted in the plugin's global configuration file How to fix Insufficiently Protected Credentials? There is no fixed version for | [0,) |
org.jvnet.hudson.plugins:ftppublisher is a Jenkins plugin used to upload project artifacts and whole directories to an ftp server. Affected versions of this package are vulnerable to Access Control Bypass. A missing permission check in a form validation method allows users with Overall/Read permission to initiate a connection test to an attacker-specified FTP server with attacker-specified credentials. Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability (CVE-2019-1003058). How to fix Access Control Bypass? There is no fixed version for | [0,) |