Jenkins Zowe Zdevops Plugin
Monthly
Missing authorization in Jenkins Zowe zDevOps Plugin (≤1.1.3.50.ve350c9b_450b_1) allows an authenticated low-privilege user holding only Overall/Read permission to invoke an unprotected plugin endpoint, supplying attacker-controlled connection parameters and externally obtained credential IDs to capture secrets stored in the Jenkins credential store. The Jenkins project confirmed the flaw under SECURITY-3747 and published an advisory on 2026-06-24. No public exploit code or active exploitation has been identified; EPSS places this at the 3rd percentile and SSVC rates exploitation as none with non-automatable attack mechanics.
Cross-site request forgery in Jenkins Zowe zDevOps Plugin version 1.1.3.50.ve350c9b_450b_1 and earlier enables network-based attackers to force authenticated Jenkins users into making unauthorized outbound HTTP connections to attacker-controlled infrastructure, using credential IDs the attacker obtained through a separate method to capture secrets stored in Jenkins. The attack requires high complexity - specifically, the attacker must pre-obtain valid Jenkins credential IDs via an independent channel before the CSRF vector becomes useful. No public exploit code exists and no active exploitation is confirmed; EPSS stands at 0.09% (0th percentile), reflecting negligible observed exploitation interest.
Missing authorization in Jenkins Zowe zDevOps Plugin (≤1.1.3.50.ve350c9b_450b_1) allows an authenticated low-privilege user holding only Overall/Read permission to invoke an unprotected plugin endpoint, supplying attacker-controlled connection parameters and externally obtained credential IDs to capture secrets stored in the Jenkins credential store. The Jenkins project confirmed the flaw under SECURITY-3747 and published an advisory on 2026-06-24. No public exploit code or active exploitation has been identified; EPSS places this at the 3rd percentile and SSVC rates exploitation as none with non-automatable attack mechanics.
Cross-site request forgery in Jenkins Zowe zDevOps Plugin version 1.1.3.50.ve350c9b_450b_1 and earlier enables network-based attackers to force authenticated Jenkins users into making unauthorized outbound HTTP connections to attacker-controlled infrastructure, using credential IDs the attacker obtained through a separate method to capture secrets stored in Jenkins. The attack requires high complexity - specifically, the attacker must pre-obtain valid Jenkins credential IDs via an independent channel before the CSRF vector becomes useful. No public exploit code exists and no active exploitation is confirmed; EPSS stands at 0.09% (0th percentile), reflecting negligible observed exploitation interest.