com.groupon.jenkins-ci.plugins:DotCi (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package com.groupon.jenkins-ci.plugins:DotCi, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2022-41237 — CVSS 9.8 (critical): Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a…
• CVE-2022-41238 — CVSS 9.8 (critical): A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs…
• CVE-2022-41239 — CVSS 5.4 (medium): Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying…