A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin in form-related methods allowed users with Overall/Read access to enumerate credential ID of the credentials stored in Jenkins.
A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the credentials stored in Jenkins.