Jenkins plugins Multiple Vulnerabilities (2026-08-05)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(332686);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/07");

  script_cve_id(
    "CVE-2026-70426",
    "CVE-2026-70427",
    "CVE-2026-70428",
    "CVE-2026-70431",
    "CVE-2026-70432",
    "CVE-2026-70433",
    "CVE-2026-70434",
    "CVE-2026-70435",
    "CVE-2026-70436",
    "CVE-2026-70437",
    "CVE-2026-70438",
    "CVE-2026-70439",
    "CVE-2026-70440",
    "CVE-2026-70441",
    "CVE-2026-70442",
    "CVE-2026-70443",
    "CVE-2026-70444",
    "CVE-2026-70445",
    "CVE-2026-70446",
    "CVE-2026-70447",
    "CVE-2026-70448"
  );
  script_xref(name:"JENKINS", value:"2026-08-05");
  script_xref(name:"IAVA", value:"2026-A-0812");

  script_name(english:"Jenkins plugins Multiple Vulnerabilities (2026-08-05)");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are
affected by multiple vulnerabilities:

  - In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2...
    (CVE-2026-70426)

  - Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting...
    (CVE-2026-70428)

  - A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with...
    (CVE-2026-70435)

  - Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check ...
    (CVE-2026-70436)

  - Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a...
    (CVE-2026-70437)

  - Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing...
    (CVE-2026-70439)

  - Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate...
    (CVE-2026-70443)

  - A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier...
    (CVE-2026-70444)

  - Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with...
    (CVE-2026-70447)

  - Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML...
    (CVE-2026-70448)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2026-08-05");
  script_set_attribute(attribute:"solution", value:
"Update Jenkins plugins to the following versions:
  - AWS CodeBuild Plugin: See vendor advisory
  - CodeSonar Plugin: See vendor advisory
  - External Workspace Manager Plugin to version 1.4.2 or later
  - Google Chat Notification Plugin: See vendor advisory
  - HCL AppScan Plugin to version 1.8.4 or later
  - Horreum Plugin: See vendor advisory
  - Ivy Report Plugin: See vendor advisory
  - Multijob Plugin to version 677.v7ffc23d6a_4c2 or later
  - Parameterized Remote Trigger Plugin: See vendor advisory
  - Qualys Container Scanning Connector Plugin: See vendor advisory
  - Sauce OnDemand Plugin: See vendor advisory
  - SCM-Manager Plugin to version 1.12.1 or later
  - Summary Display Plugin: See vendor advisory
  - Violation Comments to GitLab Plugin: See vendor advisory
  - Webhook Secret Credentials Provider Plugin to version 32.v09c9b_522f0a_8 or later
  - XML Job to Job DSL Plugin: See vendor advisory

See vendor advisory for more details.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-70441");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-70426");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/05");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:jenkins:jenkins");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("jenkins_plugins_detect.nbin", "jenkins_win_installed.nbin", "jenkins_nix_installed.nbin", "macosx_jenkins_installed.nbin");
  script_require_keys("installed_sw/Jenkins");

  exit(0);
}

include('vcf_extras.inc');

var constraints = [
    {'max_version' : '0.59', 'fixed_display' : 'See vendor advisory', 'plugin' : 'AWS CodeBuild Plugin'},
    {'max_version' : '3.6.0', 'fixed_display' : 'See vendor advisory', 'plugin' : 'CodeSonar Plugin'},
    {'max_version' : '1.4.1', 'fixed_version' : '1.4.2', 'plugin' : 'External Workspace Manager Plugin'},
    {'max_version' : '166', 'fixed_display' : 'See vendor advisory', 'plugin' : 'Google Chat Notification Plugin'},
    {'max_version' : '1.8.3', 'fixed_version' : '1.8.4', 'plugin' : 'HCL AppScan Plugin'},
    {'max_version' : '0.16.162', 'fixed_display' : 'See vendor advisory', 'plugin' : 'Horreum Plugin'},
    {'max_version' : '1.2', 'fixed_display' : 'See vendor advisory', 'plugin' : 'Ivy Report Plugin'},
    {'max_version' : '669', 'fixed_version' : '677', 'fixed_display' : '677.v7ffc23d6a_4c2', 'plugin' : 'Multijob Plugin'},
    {'max_version' : '3.2.2', 'fixed_display' : 'See vendor advisory', 'plugin' : 'Parameterized Remote Trigger Plugin'},
    {'max_version' : '1.8.0.5', 'fixed_display' : 'See vendor advisory', 'plugin' : 'Qualys Container Scanning Connector Plugin'},
    {'max_version' : '2.2.0', 'fixed_display' : 'See vendor advisory', 'plugin' : 'Sauce OnDemand Plugin'},
    {'max_version' : '1.11.1', 'fixed_version' : '1.12.1', 'plugin' : 'SCM-Manager Plugin'},
    {'max_version' : '1.15', 'fixed_display' : 'See vendor advisory', 'plugin' : 'Summary Display Plugin'},
    {'max_version' : '2.62.0', 'fixed_display' : 'See vendor advisory', 'plugin' : 'Violation Comments to GitLab Plugin'},
    {'max_version' : '16', 'fixed_version' : '32', 'fixed_display' : '32.v09c9b_522f0a_8', 'plugin' : 'Webhook Secret Credentials Provider Plugin'},
    {'max_version' : '0.1.13', 'fixed_display' : 'See vendor advisory', 'plugin' : 'XML Job to Job DSL Plugin'}
];

var app_info = vcf::jenkins::plugin::get_app_info(plugins:constraints);

vcf::jenkins::plugin::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);