A Jenkins plugin with HIGH severity CVE is installed on a Jenkins Instance

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_356
Category - Subcategory	Pipeline Configuration - 3rd Party Services
Severity	HIGH

Impact

A Jenkins plugin with a HIGH severity CVE is used in a Jenkins Instance. Using such plugin is a tier-one security risk. Because Jenkins often serves as the "keys to the kingdom"—holding credentials for production servers, cloud environments, and proprietary source code—a single vulnerable plugin can compromise your entire organization.