Nexus Task Runner
Monthly
The Jenkins Nexus Task Runner Plugin 0.9.2 and earlier omits a permission check on a plugin endpoint, so an authenticated Jenkins user holding only Overall/Read permission can make the Jenkins controller open outbound connections to an arbitrary attacker-chosen URL using credentials referenced by ID from Jenkins' credential store (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Exposure is bounded: the assessed impact is integrity-only, with no direct secret disclosure or availability effect, and exploitation requires the attacker to already be authenticated with read access. EPSS is 0.25% (15th percentile) and there is no public exploit code and no confirmed active exploitation (not in CISA KEV), so this is a low-priority issue despite being a genuine vulnerability; real-world risk rises only where Overall/Read is granted to anonymous or low-trust accounts.
Cross-site request forgery in the Jenkins Nexus Task Runner Plugin 0.9.2 and earlier lets an attacker force an outbound connection to an attacker-specified URL using attacker-specified credentials, riding the session of a logged-in Jenkins user who is tricked into loading hostile web content. Successful abuse requires victim interaction plus a concurrently authenticated Jenkins session holding the relevant configuration permissions, and the impact is limited to unauthorized outbound requests and credential use rather than code execution or data disclosure. EPSS is low at roughly 0.21% (10th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
The Jenkins Nexus Task Runner Plugin 0.9.2 and earlier omits a permission check on a plugin endpoint, so an authenticated Jenkins user holding only Overall/Read permission can make the Jenkins controller open outbound connections to an arbitrary attacker-chosen URL using credentials referenced by ID from Jenkins' credential store (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). Exposure is bounded: the assessed impact is integrity-only, with no direct secret disclosure or availability effect, and exploitation requires the attacker to already be authenticated with read access. EPSS is 0.25% (15th percentile) and there is no public exploit code and no confirmed active exploitation (not in CISA KEV), so this is a low-priority issue despite being a genuine vulnerability; real-world risk rises only where Overall/Read is granted to anonymous or low-trust accounts.
Cross-site request forgery in the Jenkins Nexus Task Runner Plugin 0.9.2 and earlier lets an attacker force an outbound connection to an attacker-specified URL using attacker-specified credentials, riding the session of a logged-in Jenkins user who is tricked into loading hostile web content. Successful abuse requires victim interaction plus a concurrently authenticated Jenkins session holding the relevant configuration permissions, and the impact is limited to unauthorized outbound requests and credential use rather than code execution or data disclosure. EPSS is low at roughly 0.21% (10th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.