Jenkins plugins Multiple Vulnerabilities (2026-04-29)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(310885);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id(
    "CVE-2026-42519",
    "CVE-2026-42520",
    "CVE-2026-42521",
    "CVE-2026-42522",
    "CVE-2026-42523",
    "CVE-2026-42524",
    "CVE-2026-42525"
  );
  script_xref(name:"JENKINS", value:"2026-04-29");

  script_name(english:"Jenkins plugins Multiple Vulnerabilities (2026-04-29)");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are
affected by multiple vulnerabilities:

  - High HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file.
    This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with
    Item/Configure permission. HTML Publisher Plugin 427.1 escapes job name and URL when generating the legacy
    wrapper file. This fix only applies to newly generated wrappers. On Jenkins 2.539 and newer, LTS 2.541.1
    and newer, enforcing Content Security Policy protection mitigates this vulnerability. This vulnerability
    has been reported through the Jenkins Bug Bounty Program sponsored by the European Commission.
    (CVE-2026-42524)

  - Medium Script Security Plugin 1399.ve6a_66547f6e1 and earlier does not perform a permission check in an
    HTTP endpoint. This allows attackers with Overall/Read permission to enumerate pending and approved Script
    Security classpaths. Script Security Plugin 1402.v94c9ce464861 requires Overall/Administer permission to
    enumerate pending and approved Script Security classpaths. This vulnerability has been reported through
    the Jenkins Bug Bounty Program sponsored by the European Commission. (CVE-2026-42519)

  - High Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and
    zip file credentials. This allows attackers able to provide credentials to a job to write files to
    arbitrary locations on the node filesystem. If Jenkins is configured to allow a low-privileged user to
    configure file or zip file credentials used for a job running on the built-in node, this can lead to
    remote code execution. Credentials Binding Plugin 720.v3f6decef43ea_ sanitizes the file name provided for
    file and zip file credentials, preventing path traversal. This vulnerability has been reported through the
    Jenkins Bug Bounty Program sponsored by the European Commission. (CVE-2026-42520)

  - Medium Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes
    parameterless constructors of classes specified in configuration when deserializing inheritance
    strategies, without restricting the classes that can be instantiated. This can be abused by attackers with
    Item/Configure permission to instantiate arbitrary types, which may lead to information disclosure or
    other impacts depending on the classes available on the classpath. Matrix Authorization Strategy Plugin
    3.2.10 verifies that the class being instantiated is an inheritance strategy implementation, preventing
    instantiation of arbitrary types. This vulnerability has been reported through the Jenkins Bug Bounty
    Program sponsored by the European Commission. (CVE-2026-42521)

  - Medium GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier does not perform a permission check
    in a method implementing form validation. This allows attackers with Overall/Read permission to connect to
    an attacker-specified URL with attacker-specified GitHub App credentials. GitHub Branch Source Plugin
    1967.1969.v205fd594c821 requires Overall/Manage permission to perform the connection test. This
    vulnerability has been reported through the Jenkins Bug Bounty Program sponsored by the European
    Commission. (CVE-2026-42522)

  - High GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript
    implementing validation of the feature GitHub hook trigger for GITScm polling. This results in a stored
    cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read
    permission. GitHub Plugin 1.46.0.1 no longer processes the current job URL as part of JavaScript
    implementing validation of the feature GitHub hook trigger for GITScm polling. This vulnerability has
    been reported through the Jenkins Bug Bounty Program sponsored by the European Commission.
    (CVE-2026-42523)

  - Medium Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the
    redirect URL after login. This allows attackers to perform phishing attacks by having users go to a
    Jenkins URL that will forward them to a different site after successful authentication. Microsoft Entra ID
    (previously Azure AD) Plugin 667.v4c5827a_e74a_0 only redirects to relative (Jenkins) URLs.
    (CVE-2026-42525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2026-04-29");
  script_set_attribute(attribute:"solution", value:
"Update Jenkins plugins to the following versions:
  - Credentials Binding Plugin to version 720.v3f6decef43ea_ or later
  - GitHub Branch Source Plugin to version 1967.1969.v205fd594c821 or later
  - GitHub Plugin to version 1.46.0.1 or later
  - HTML Publisher Plugin to version 427.1 or later
  - Matrix Authorization Strategy Plugin to version 3.2.10 or later
  - Microsoft Entra ID (previously Azure AD) Plugin to version 667.v4c5827a_e74a_0 or later
  - Script Security Plugin to version 1402.v94c9ce464861 or later

See vendor advisory for more details.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-42524");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-42523");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/29");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:jenkins:jenkins");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("jenkins_plugins_detect.nbin", "jenkins_win_installed.nbin", "jenkins_nix_installed.nbin", "macosx_jenkins_installed.nbin");
  script_require_keys("installed_sw/Jenkins");

  exit(0);
}

include('vcf_extras.inc');

var constraints = [
    {'max_version' : '719', 'fixed_version' : '720', 'fixed_display' : '720.v3f6decef43ea_', 'plugin' : 'Credentials Binding Plugin'},
    {'max_version' : '1967', 'fixed_version' : '1967.1969', 'fixed_display' : '1967.1969.v205fd594c821', 'plugin' : 'GitHub Branch Source Plugin'},
    {'max_version' : '1.46.0', 'fixed_version' : '1.46.0.1', 'plugin' : 'GitHub Plugin'},
    {'max_version' : '427', 'fixed_version' : '427.1', 'plugin' : 'HTML Publisher Plugin'},
    {'max_version' : '3.2.9', 'fixed_version' : '3.2.10', 'plugin' : 'Matrix Authorization Strategy Plugin'},
    {'max_version' : '666', 'fixed_version' : '667', 'fixed_display' : '667.v4c5827a_e74a_0', 'plugin' : 'Microsoft Entra ID (previously Azure AD) Plugin'},
    {'max_version' : '1399', 'fixed_version' : '1402', 'fixed_display' : '1402.v94c9ce464861', 'plugin' : 'Script Security Plugin'}
];

var app_info = vcf::jenkins::plugin::get_app_info(plugins:constraints);

vcf::jenkins::plugin::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE,
    flags:{'xss':TRUE}
);