Jenkins LTS < 2.580.2 / Jenkins weekly < 2.588 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(373229);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/28");

  script_cve_id(
    "CVE-2026-117612",
    "CVE-2026-117613",
    "CVE-2026-117614",
    "CVE-2026-117615",
    "CVE-2026-117616",
    "CVE-2026-117617",
    "CVE-2026-117618",
    "CVE-2026-117619",
    "CVE-2026-117620",
    "CVE-2026-117621",
    "CVE-2026-117622",
    "CVE-2026-117623",
    "CVE-2026-117624",
    "CVE-2026-117625",
    "CVE-2026-117626"
  );
  script_xref(name:"JENKINS", value:"2026-10-28");

  script_name(english:"Jenkins LTS < 2.580.2 / Jenkins weekly < 2.588 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins
LTS prior to 2.580.2 or Jenkins weekly prior to 2.588. It is, therefore, affected by multiple vulnerabilities:

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of
    breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability
    exploitable by attackers with Overall/Read permission. (CVE-2026-117623)

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted
    file only before creating its parent directories, not immediately before writing it, and allows symbolic
    links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure
    permission to write files to arbitrary locations on the Jenkins controller file system. (CVE-2026-117617)

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes
    referenced by the `resolves-to` attribute during XStream deserialization. (CVE-2026-117612)

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after
    deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted
    `config.xml` files that can lead to, e.g., stored cross-site scripting (XSS) vulnerabilities.
    (CVE-2026-117613)

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent
    configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they
    have been approved by an administrator, allowing attackers with Agent/Configure permission to execute
    arbitrary code in the context of the Jenkins controller JVM. (CVE-2026-117614)

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an
    item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary
    files on the Jenkins controller file system. (CVE-2026-117615)

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name
    without validating the name, allowing attackers with Overall/Read permission to load any config.xml file
    on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file
    when that agent is saved, potentially resulting in arbitrary code execution. (CVE-2026-117616)

  - In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user
    account does not check whether the setup wizard has been completed, resulting in a race condition that
    allows unauthenticated attackers to create an administrator account while the initial user account is
    being replaced. (CVE-2026-117618)

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic
    authentication, including with an API token, to obtain a remember me cookie, allowing attackers who have
    obtained a user's API token to retain access to Jenkins using a remember me cookie after the API token
    is revoked or expires. (CVE-2026-117619)

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to
    trigger warnings in the Manage Old Data feature that can be acted on by administrators to inject
    attacker-controlled data, overriding existing user account information, including login passwords.
    (CVE-2026-117620)

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the
    workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability
    exploitable by attackers in control of agent processes. (CVE-2026-117621)

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the
    Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability
    exploitable by attackers in control of agent processes. (CVE-2026-117622)

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on
    deserializing objects of types marked as storing their configuration in independent top-level
    configuration files as nested values, allowing attackers to bypass the root element check and potentially
    inject nested objects. (CVE-2026-117624)

  - A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with
    Overall/Read permission to obtain the server, port, user name, and no-proxy host list of the configured
    HTTP proxy. (CVE-2026-117625)

  - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path
    traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with
    Overall/Read permission to obtain the names, sizes, and last modification times of files in the
    $JENKINS_HOME, and attackers with Item/Workspace permission to obtain the names of jobs that have a
    workspace on the same agent. (CVE-2026-117626)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2026-10-28");
  script_set_attribute(attribute:"solution", value:
"Upgrade Jenkins weekly to version 2.588 or later, or Jenkins LTS to version 2.580.2 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-117623");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-117617");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/28");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:jenkins:jenkins");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("jenkins_detect.nasl", "jenkins_win_installed.nbin", "jenkins_nix_installed.nbin", "macosx_jenkins_installed.nbin");
  script_require_keys("installed_sw/Jenkins");

  exit(0);
}

include('vcf_extras.inc');

var constraints = [
  { 'max_version' : '2.587', 'fixed_version' : '2.588', 'edition' : 'Open Source' },
  { 'max_version' : '2.580.1', 'fixed_version' : '2.580.2', 'edition' : 'Open Source LTS' }
];

var app_info = vcf::combined_get_app_info(app:'Jenkins');

vcf::jenkins::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE,
    flags:{'xss':TRUE}
);