Themis
Monthly
Missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows any authenticated user holding the low-privilege Overall/Read permission to make the Jenkins controller open an outbound HTTP connection to a server the attacker chooses. Exploitation requires user interaction to trigger the connection, and the assessed impact is limited to integrity only (no confidentiality or availability loss), which keeps real-world risk low despite the network-reachable attack vector. The CVSS 3.1 base score is 4.3, EPSS is 0.29% (20th percentile), no public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory confirms a fix. Note that the published vector lists PR:N while the described Overall/Read prerequisite means the issue is in practice authenticated-only.
Cross-site request forgery in Jenkins Themis Plugin 1.4.1 and earlier lets an attacker cause an affected Jenkins controller to open an outbound connection to an attacker-specified HTTP server by luring a victim into visiting malicious web content. The affected endpoint performs no CSRF validation, so the forged request is executed in the security context of the victim's active Jenkins session; the CVSS vector (AV:N/AC:L/PR:N/UI:R) means the attacker needs no credentials but must persuade a logged-in user to interact with attacker-controlled content. Impact is confined to integrity (C:N/I:L/A:N), EPSS is only 0.23% (percentile 12), and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV: not listed).
Missing permission check in Jenkins Themis Plugin 1.4.1 and earlier allows any authenticated user holding the low-privilege Overall/Read permission to make the Jenkins controller open an outbound HTTP connection to a server the attacker chooses. Exploitation requires user interaction to trigger the connection, and the assessed impact is limited to integrity only (no confidentiality or availability loss), which keeps real-world risk low despite the network-reachable attack vector. The CVSS 3.1 base score is 4.3, EPSS is 0.29% (20th percentile), no public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory confirms a fix. Note that the published vector lists PR:N while the described Overall/Read prerequisite means the issue is in practice authenticated-only.
Cross-site request forgery in Jenkins Themis Plugin 1.4.1 and earlier lets an attacker cause an affected Jenkins controller to open an outbound connection to an attacker-specified HTTP server by luring a victim into visiting malicious web content. The affected endpoint performs no CSRF validation, so the forged request is executed in the security context of the victim's active Jenkins session; the CVSS vector (AV:N/AC:L/PR:N/UI:R) means the attacker needs no credentials but must persuade a logged-in user to interact with attacker-controlled content. Impact is confined to integrity (C:N/I:L/A:N), EPSS is only 0.23% (percentile 12), and no public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV: not listed).