Jenkins plugins Multiple Vulnerabilities (2026-09-02)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(342361);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/02");

  script_cve_id(
    "CVE-2026-84645",
    "CVE-2026-84653",
    "CVE-2026-84658",
    "CVE-2026-84659",
    "CVE-2026-84660",
    "CVE-2026-84661",
    "CVE-2026-84662",
    "CVE-2026-84663",
    "CVE-2026-84664",
    "CVE-2026-84665",
    "CVE-2026-84666",
    "CVE-2026-84667",
    "CVE-2026-84668",
    "CVE-2026-84669",
    "CVE-2026-84670",
    "CVE-2026-84671",
    "CVE-2026-84672",
    "CVE-2026-84673",
    "CVE-2026-84674",
    "CVE-2026-84675",
    "CVE-2026-84676",
    "CVE-2026-84677"
  );
  script_xref(name:"JENKINS", value:"2026-09-02");

  script_name(english:"Jenkins plugins Multiple Vulnerabilities (2026-09-02)");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are
affected by multiple vulnerabilities:

  - Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's
    appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon
    containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.
    (CVE-2026-84673)

  - Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider
    metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled
    content and authenticate as any user. (CVE-2026-84668)

  - Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group
    permissions using both the group's unique object ID and its display name, allowing attackers who can
    create an Entra group with a colliding display name to gain the permissions configured for a privileged
    group. (CVE-2026-84672)

  - Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with
    Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. (CVE-2026-84674)

  - Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml
    files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or
    access to the Jenkins controller file system. (CVE-2026-84676)

  - Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names,
    descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site
    scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.
    (CVE-2026-84677)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2026-09-02");
  script_set_attribute(attribute:"solution", value:
"Update Jenkins plugins to the following versions:
  - Allure Plugin to version 2.36.0 or later
  - Customizable Header Plugin to version 330.v8a_8d87511ea_1 or later
  - File Parameter Plugin to version 433.va_0b_80359d54d or later
  - GitLab Plugin to version 1.9.182144.vc1c369226a_52 or later
  - Job Configuration History Plugin to version 1380.v762185b_9a_793 or later
  - LDAP Plugin to version 825.v2fca_37dd5b_cb_ or later
  - Microsoft Entra ID (previously Azure AD) Plugin to version 711.v34046f788fd7 or later
  - Parameterized Remote Trigger Plugin: See vendor advisory
  - Performance Plugin to version 1017.v9e9f7b_b_b_c5e7 or later
  - Pipeline: Build Step Plugin to version 601.v6d4c6d1a_9dc7 or later
  - Pipeline: Groovy Libraries Plugin to version 805.va_fc79344957d or later
  - SAML Plugin to version 4.623.v7875d61cd9f5 or later
  - Script Security Plugin to version 1415.v9a_f9b_3a_c253d or later
  - SonarQube Scanner Plugin to version 2.19.0 or later
  - ThinBackup Plugin to version 2.1.5 or later
  - TICS Plugin to version 2026.1.0 or later
  - XebiaLabs XL Deploy Plugin to version 26.3.0 or later

See vendor advisory for more details.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-84673");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/02");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:jenkins:jenkins");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("jenkins_plugins_detect.nbin", "jenkins_win_installed.nbin", "jenkins_nix_installed.nbin", "macosx_jenkins_installed.nbin");
  script_require_keys("installed_sw/Jenkins");

  exit(0);
}

include('vcf_extras.inc');

var constraints = [
    {'max_version' : '2.35.2', 'fixed_version' : '2.36.0', 'plugin' : 'Allure Plugin'},
    {'max_version' : '295', 'fixed_version' : '330', 'fixed_display' : '330.v8a_8d87511ea_1', 'plugin' : 'Customizable Header Plugin'},
    {'max_version' : '425', 'fixed_version' : '433', 'fixed_display' : '433.va_0b_80359d54d', 'plugin' : 'File Parameter Plugin'},
    {'max_version' : '1.9.16', 'fixed_version' : '1.9.182144', 'fixed_display' : '1.9.182144.vc1c369226a_52', 'plugin' : 'GitLab Plugin'},
    {'max_version' : '1367', 'fixed_version' : '1380', 'fixed_display' : '1380.v762185b_9a_793', 'plugin' : 'Job Configuration History Plugin'},
    {'max_version' : '807.809', 'fixed_version' : '825', 'fixed_display' : '825.v2fca_37dd5b_cb_', 'plugin' : 'LDAP Plugin'},
    {'max_version' : '710', 'fixed_version' : '711', 'fixed_display' : '711.v34046f788fd7', 'plugin' : 'Microsoft Entra ID (previously Azure AD) Plugin'},
    {'max_version' : '3.2.2', 'fixed_display' : 'See vendor advisory', 'plugin' : 'Parameterized Remote Trigger Plugin'},
    {'max_version' : '1015', 'fixed_version' : '1017', 'fixed_display' : '1017.v9e9f7b_b_b_c5e7', 'plugin' : 'Performance Plugin'},
    {'max_version' : '599', 'fixed_version' : '601', 'fixed_display' : '601.v6d4c6d1a_9dc7', 'plugin' : 'Pipeline: Build Step Plugin'},
    {'max_version' : '798', 'fixed_version' : '805', 'fixed_display' : '805.va_fc79344957d', 'plugin' : 'Pipeline: Groovy Libraries Plugin'},
    {'max_version' : '4.618', 'fixed_version' : '4.623', 'fixed_display' : '4.623.v7875d61cd9f5', 'plugin' : 'SAML Plugin'},
    {'max_version' : '1412', 'fixed_version' : '1415', 'fixed_display' : '1415.v9a_f9b_3a_c253d', 'plugin' : 'Script Security Plugin'},
    {'max_version' : '2.18.3', 'fixed_version' : '2.19.0', 'plugin' : 'SonarQube Scanner Plugin'},
    {'max_version' : '2.1.4', 'fixed_version' : '2.1.5', 'plugin' : 'ThinBackup Plugin'},
    {'max_version' : '2025.1.1', 'fixed_version' : '2026.1.0', 'plugin' : 'TICS Plugin'},
    {'max_version' : '26.1.0', 'fixed_version' : '26.3.0', 'plugin' : 'XebiaLabs XL Deploy Plugin'}
];

var app_info = vcf::jenkins::plugin::get_app_info(plugins:constraints);

vcf::jenkins::plugin::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE,
    flags:{'xss':TRUE}
);