# org.jenkins-ci.plugins:electricflow (Maven) vulnerabilities

9 known vulnerabilities, with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.jenkins-ci.plugins/electricflow

## Advisories (9)

### [CVE-2023-46655](https://cve.now/CVE-2023-46655): Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are…

- Severity: Unrated
- Published: Oct 25, 2023
- Affected: fixed in 1.1.33.

### [CVE-2023-46654](https://cve.now/CVE-2023-46654): Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup…

- Severity: Unrated
- Published: Oct 25, 2023
- Affected: fixed in 1.1.33.

### [CVE-2021-21647](https://cve.now/CVE-2021-21647): Jenkins CloudBees CD Plugin 1.1.21 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Item/Read…

- Severity: Unrated
- Published: Apr 21, 2021
- Affected: fixed in 1.1.18.1; from 1.1.19, fixed in 1.1.22.

### [CVE-2019-10336](https://cve.now/CVE-2019-10336): A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the…

- Severity: Unrated
- Published: Jun 11, 2019
- Affected: fixed in 1.1.7.

### [CVE-2019-10335](https://cve.now/CVE-2019-10335): A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in…

- Severity: Unrated
- Published: Jun 11, 2019
- Affected: fixed in 1.1.7.

### [CVE-2019-10334](https://cve.now/CVE-2019-10334): Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when…

- Severity: Unrated
- Published: Jun 11, 2019
- Affected: fixed in 1.1.7.

### [CVE-2019-10333](https://cve.now/CVE-2019-10333): Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read…

- Severity: Unrated
- Published: Jun 11, 2019
- Affected: fixed in 1.1.7.

### [CVE-2019-10332](https://cve.now/CVE-2019-10332): A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with…

- Severity: Unrated
- Published: Jun 11, 2019
- Affected: fixed in 1.1.7.

### [CVE-2019-10331](https://cve.now/CVE-2019-10331): A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed…

- Severity: Unrated
- Published: Jun 11, 2019
- Affected: fixed in 1.1.7.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.jenkins-ci.plugins:electricflow
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.