Jenkins Project Jenkins Katalon Plugin

• CVE-2022-43417 Medium 4.3 Jenkins Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using at 0.7%
• CVE-2022-43416 High 8.8 Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invoking Katalon with configurable arguments, allowing attacker 1.3%
• CVE-2022-43418 Medium 4.3 A cross-site request forgery (CSRF) vulnerability in Jenkins Katalon Plugin 1.0.33 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtaine 0.5%
• CVE-2022-43419 Medium 6.5 Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to th 0.8%