Jenkins LTS < 2.516.3 / Jenkins weekly < 2.528 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(265325);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id(
    "CVE-2025-5115",
    "CVE-2025-59474",
    "CVE-2025-59475",
    "CVE-2025-59476"
  );
  script_xref(name:"JENKINS", value:"2025-09-17");
  script_xref(name:"IAVA", value:"2025-A-0685-S");

  script_name(english:"Jenkins LTS < 2.516.3 / Jenkins weekly < 2.528 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins
LTS prior to 2.516.3 or Jenkins weekly prior to 2.528. It is, therefore, affected by multiple vulnerabilities:

  - In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client
    may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that
    should not be sent in a particular stream state, therefore forcing the server to consume resources such as
    CPU and memory. For example, a client can open a stream and then send WINDOW_UPDATE frames with window
    size increment of 0, which is illegal. Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-
    window_update , the server should send a RST_STREAM frame. The client can now open another stream and send
    another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this
    case does not exceed the max number of concurrent streams, yet the client is able to create an enormous
    amount of streams in a short period of time. The attack can be performed with other conditions (for
    example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame. Links: *
    https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h (CVE-2025-5115)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2025-09-17");
  script_set_attribute(attribute:"solution", value:
"Upgrade Jenkins weekly to version 2.528 or later, or Jenkins LTS to version 2.516.3 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-59476");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-5115");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/17");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:jenkins:jenkins");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("jenkins_detect.nasl", "jenkins_win_installed.nbin", "jenkins_nix_installed.nbin", "macosx_jenkins_installed.nbin");
  script_require_keys("installed_sw/Jenkins");

  exit(0);
}

include('vcf_extras.inc');

var constraints = [
  { 'max_version' : '2.527', 'fixed_version' : '2.528', 'edition' : 'Open Source' },
  { 'max_version' : '2.516.2', 'fixed_version' : '2.516.3', 'edition' : 'Open Source LTS' }
];

var app_info = vcf::combined_get_app_info(app:'Jenkins');

vcf::jenkins::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);