{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57297", "assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "state": "PUBLISHED", "assignerShortName": "jenkins", "dateReserved": "2026-06-24T08:41:44.358Z", "datePublished": "2026-06-24T13:20:13.947Z", "dateUpdated": "2026-06-24T13:20:13.947Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2026-06-24T13:20:13.947Z"}, "affected": [{"vendor": "Jenkins Project", "product": "Jenkins Contrast Continuous Application Security Plugin", "versions": [{"version": "0", "versionType": "maven", "lessThanOrEqual": "3.11", "status": "affected"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key."}], "references": [{"name": "Jenkins Security Advisory 2026-06-24", "url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3697%20(1)", "tags": ["vendor-advisory"]}]}}}

{}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.11]"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "Jenkins Contrast Continuous Application Security Plugin", "source": "cna", "vendor": "Jenkins Project"}, "product": "contrast_continuous_application_security", "vendor": "jenkins"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.11]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "jenkins_contrast_continuous_application_security_plugin", "vendor": "jenkins_project"}], "created": "2026-06-24T15:15:04.695242+00:00", "title": "Missing Permission Check Enables Arbitrary Outbound Connections in Jenkins Contrast Plugin", "updated": "2026-06-24T20:41:01.442645+00:00", "vendors": ["jenkins", "jenkins$PRODUCT$contrast_continuous_application_security", "jenkins_project", "jenkins_project$PRODUCT$jenkins_contrast_continuous_application_security_plugin"], "weaknesses": ["CWE-284"]}