Jenkins Role-based Authorization Strategy — known CVE vulnerabilities

Every CVE whose affected-product data names Jenkins Role-based Authorization Strategy, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2023-28668 — CVSS 9.8 (critical): Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.
• CVE-2017-1000090 — CVSS 8.8 (high): Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site…
• CVE-2020-2286 — CVSS 8.8 (high): Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when the configuration is…
• CVE-2021-21624 — CVSS 4.3 (medium): An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows attackers with Item/Read…