Jenkins Assembla vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Jenkins Assembla: 3 record(s), with affected versions and fixes.
cpe:2.3:a:jenkins:assembla

CVE-2026-57305 Medium · 5.4 CWE-352 Jun 24, 2026

Cross-Site Request Forgery (CSRF) in Jenkins Assembla

A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password.

CVE-2026-57304 Medium · 5.4 CWE-862 Jun 24, 2026

Missing Authorization in Jenkins Assembla

A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.

CVE-2026-57303 High · 7.1 CWE-918 Jun 24, 2026

Server-Side Request Forgery (SSRF) in Jenkins Assembla

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.