VYPR

CWE-693

Protection Mechanism Failure

PillarDraft

Description

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

This weakness covers three distinct situations. A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack. An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended. Finally, an "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.

Hierarchy (View 1000)

Parents

none

Related attack patterns (CAPEC)

CAPEC-1 · CAPEC-107 · CAPEC-127 · CAPEC-17 · CAPEC-20 · CAPEC-22 · CAPEC-237 · CAPEC-36 · CAPEC-477 · CAPEC-480 · CAPEC-51 · CAPEC-57 · CAPEC-59 · CAPEC-65 · CAPEC-668 · CAPEC-74 · CAPEC-87

CVEs mapped to this weakness (353)

page 17 of 18
  • CVE-2022-41235Sep 21, 2022
    Jenkins Project
    DeployHub Plugin
    risk 0.00cvss —epss 0.01

    Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

  • CVE-2022-36900Jul 27, 2022
    risk 0.00cvss —epss 0.01

    Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.

  • CVE-2022-36899Jul 27, 2022
    risk 0.00cvss —epss 0.01

    Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.

  • CVE-2022-34181Jun 22, 2022
    Jenkins Project
    Jenkins Xp Dev Plugin
    risk 0.00cvss —epss 0.01

    Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist, and parsing files inside it as test results, allowing attackers able to control agent processes to create an arbitrary directory on the…

  • CVE-2022-34175Jun 22, 2022
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.01

    Jenkins 2.335 through 2.355 (both inclusive) allows attackers in some cases to bypass a protection mechanism, thereby directly accessing some view fragments containing sensitive information, bypassing any permission checks in the corresponding view.

  • CVE-2022-25197Feb 15, 2022
    Jenkins Project
    Hashicorp Vault Plugin
    risk 0.00cvss —epss 0.01

    Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

  • CVE-2022-25186Feb 15, 2022
    Jenkins Project
    Hashicorp Vault Plugin
    risk 0.00cvss —epss 0.01

    Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.

  • CVE-2022-25183Feb 15, 2022
    Jenkins Project
    Pipeline: Shared Groovy Libraries Plugin
    risk 0.00cvss —epss 0.02

    Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins…

  • CVE-2022-25182Feb 15, 2022
    Jenkins Project
    Pipeline: Shared Groovy Libraries Plugin
    risk 0.00cvss —epss 0.02

    A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller JVM using specially crafted library names if a global Pipeline…

  • CVE-2022-25181Feb 15, 2022
    Jenkins Project
    Pipeline: Shared Groovy Libraries Plugin
    risk 0.00cvss —epss 0.02

    A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global…

  • CVE-2022-23118Jan 12, 2022
    Jenkins Project
    Debian Package Builder Plugin
    risk 0.00cvss —epss 0.02

    Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path on the controller, allowing attackers able to control agent processes to invoke arbitrary OS commands on the controller.

  • CVE-2021-43578Nov 12, 2021
    Jenkins Project
    S3 publisher Plugin
    risk 0.00cvss —epss 0.01

    Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins controller file…

  • CVE-2021-21696Nov 4, 2021
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.02

    Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified…

  • CVE-2021-21690Nov 4, 2021
    Jenkins Project
    Jenkins
    risk 0.00cvss —epss 0.02

    Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

  • CVE-2021-21679Aug 31, 2021
    Jenkins Project
    Azure VM Agents Plugin
    risk 0.00cvss —epss 0.01

    Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.

  • CVE-2021-21678Aug 31, 2021
    Jenkins Project
    SAML Plugin
    risk 0.00cvss —epss 0.01

    Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.

  • CVE-2021-32729Jul 1, 2021
    Cryptpad
    Xwiki Platform
    risk 0.00cvss —epss 0.01

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be executed by any user…

  • CVE-2021-21646Apr 21, 2021
    Jenkins Project
    Templating Engine Plugin
    risk 0.00cvss —epss 0.02

    Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

  • CVE-2020-15215Oct 6, 2020
    Electronjs
    Electron
    risk 0.00cvss —epss 0.01

    Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affected. This is a…

  • CVE-2020-15174Oct 6, 2020
    Electronjs
    Electron
    risk 0.00cvss —epss 0.01

    In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The…