Jenkins plugins Multiple Vulnerabilities (2026-09-16)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346277);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/16");

  script_cve_id(
    "CVE-2026-92122",
    "CVE-2026-92123",
    "CVE-2026-92124",
    "CVE-2026-92125",
    "CVE-2026-92126",
    "CVE-2026-92127",
    "CVE-2026-92128",
    "CVE-2026-92129",
    "CVE-2026-92130",
    "CVE-2026-92131",
    "CVE-2026-92132",
    "CVE-2026-92133",
    "CVE-2026-92134",
    "CVE-2026-92135",
    "CVE-2026-92136",
    "CVE-2026-92137",
    "CVE-2026-92138",
    "CVE-2026-92139",
    "CVE-2026-92140",
    "CVE-2026-92141"
  );
  script_xref(name:"JENKINS", value:"2026-09-16");

  script_name(english:"Jenkins plugins Multiple Vulnerabilities (2026-09-16)");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are
affected by multiple vulnerabilities:

  - Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push
    webhook payloads in build causes, resulting in a stored cross-site scripting (XSS) vulnerability
    exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint.
    (CVE-2026-92140)

  - Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for
    Robot Framework report files is contained within the build directory on the Jenkins controller, allowing
    attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller
    file system with attacker-specified content, which can lead to remote code execution. (CVE-2026-92137)

  - Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through
    the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method
    of the same name as an interface method, allowing attackers with permission to define and run sandboxed
    scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context
    of the Jenkins controller JVM. (CVE-2026-92122)

  - Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed
    on a null receiver (method calls, property and attribute accesses, and array accesses), allowing attackers
    with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection
    and execute arbitrary code in the context of the Jenkins controller JVM. (CVE-2026-92123)

  - Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform
    with the elements it reads from a collection that a sandboxed script casts to another type but performs
    the cast on the collection itself, allowing attackers with permission to define and run sandboxed scripts,
    including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the
    Jenkins controller JVM. (CVE-2026-92124)

  - Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the
    @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed
    scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the
    sandbox protection and executing arbitrary code in the context of the Jenkins controller JVM.
    (CVE-2026-92125)

  - Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations
    whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and
    run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable class is
    present on the classpath of the component that evaluates the script. (CVE-2026-92126)

  - Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath
    entries in an item configuration when a user with Overall/Administer permission copies the item, or
    updates that configuration through the REST API or CLI, allowing attackers able to define classpath
    entries to execute arbitrary code in the context of the Jenkins controller JVM. (CVE-2026-92127)

  - Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL
    twice, confirming the approval of the first download and loading the classpath entries from the second,
    allowing attackers able to define classpath entries to execute arbitrary code in the context of the
    Jenkins controller JVM. (CVE-2026-92128)

  - Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed
    scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define
    and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute code outside
    the sandbox. (CVE-2026-92129)

  - Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context
    for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission
    to access and capture credentials they are not entitled to. (CVE-2026-92130)

  - Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library
    path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows
    symbolic links to locations outside of the SCM checkout when retrieving the library, resulting in a path
    traversal vulnerability, allowing attackers able to configure Pipelines to read files in a resources
    directory and to delete files in a test directory on the Jenkins controller file system. (CVE-2026-92131)

  - Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan
    link detected in the build log, even when a Develocity server URL is configured in the global
    configuration, allowing attackers able to control the build log to capture the Develocity access key
    configured in the global configuration by having Jenkins connect to an attacker-specified URL.
    (CVE-2026-92132)

  - Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative
    GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder
    in which the credentials are resolved, allowing attackers with Item/Configure permission to access GitLab
    API token credentials they are not entitled to use. (CVE-2026-92133)

  - Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID
    when a job configuration is submitted through the REST API, allowing attackers with Item/Configure
    permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS)
    vulnerability. (CVE-2026-92134)

  - Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a
    job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to
    use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS)
    vulnerability. (CVE-2026-92135)

  - Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check
    reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by
    attackers with Item/Configure permission. (CVE-2026-92136)

  - The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads
    the `oauth_callback` URL from the submitted form rather than from the server-side stored request token,
    allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the victim.
    (CVE-2026-92138)

  - Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook
    payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs,
    allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook
    payload. (CVE-2026-92139)

  - Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login,
    allowing attackers to perform phishing attacks. (CVE-2026-92141)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jenkins.io/security/advisory/2026-09-16");
  script_set_attribute(attribute:"solution", value:
"Update Jenkins plugins to the following versions:
  - Bitbucket Push and Pull Request Plugin to version 4.1.0 or later
  - Bitbucket Server Integration Plugin to version 6.0.2 or later
  - Coverage Plugin to version 3.3361.v0626103a_67e6 or later
  - Gitee Plugin to version 1304.v2702f1d71cde or later
  - GitLab Plugin to version 1.2152.veec0897048b_0 or later
  - Gradle Plugin to version 2.20.1253.vc116f0763a_eb_ or later
  - Keycloak Authentication Plugin to version 2.4.2 or later
  - OWASP Dependency-Check Plugin to version 5.6.5 or later
  - Pipeline: Groovy Libraries Plugin to version 806.v408277b_33d1d or later
  - Pipeline: Multibranch Plugin to version 842.v3a_b_59b_57b_e6e or later
  - Robot Framework Plugin to version 6.3.0 or later
  - Script Security Plugin to version 1422.v06869826dd9b_ or later
  - Warnings Plugin to version 13.10259.v80f407cb_03a_e or later

See vendor advisory for more details.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-92140");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-92137");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/16");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cloudbees:jenkins");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:jenkins:jenkins");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("jenkins_plugins_detect.nbin", "jenkins_win_installed.nbin", "jenkins_nix_installed.nbin", "macosx_jenkins_installed.nbin");
  script_require_keys("installed_sw/Jenkins");

  exit(0);
}

include('vcf_extras.inc');

var constraints = [
    {'max_version' : '4.0.1', 'fixed_version' : '4.1.0', 'plugin' : 'Bitbucket Push and Pull Request Plugin'},
    {'max_version' : '6.0.1', 'fixed_version' : '6.0.2', 'plugin' : 'Bitbucket Server Integration Plugin'},
    {'max_version' : '3.3358', 'fixed_version' : '3.3361', 'fixed_display' : '3.3361.v0626103a_67e6', 'plugin' : 'Coverage Plugin'},
    {'max_version' : '1301', 'fixed_version' : '1304', 'fixed_display' : '1304.v2702f1d71cde', 'plugin' : 'Gitee Plugin'},
    {'max_version' : '1.2149', 'fixed_version' : '1.2152', 'fixed_display' : '1.2152.veec0897048b_0', 'plugin' : 'GitLab Plugin'},
    {'max_version' : '2.19.1252', 'fixed_version' : '2.20.1253', 'fixed_display' : '2.20.1253.vc116f0763a_eb_', 'plugin' : 'Gradle Plugin'},
    {'max_version' : '2.4.1', 'fixed_version' : '2.4.2', 'plugin' : 'Keycloak Authentication Plugin'},
    {'max_version' : '5.6.4', 'fixed_version' : '5.6.5', 'plugin' : 'OWASP Dependency-Check Plugin'},
    {'max_version' : '805', 'fixed_version' : '806', 'fixed_display' : '806.v408277b_33d1d', 'plugin' : 'Pipeline: Groovy Libraries Plugin'},
    {'max_version' : '841', 'fixed_version' : '842', 'fixed_display' : '842.v3a_b_59b_57b_e6e', 'plugin' : 'Pipeline: Multibranch Plugin'},
    {'max_version' : '6.2.2', 'fixed_version' : '6.3.0', 'plugin' : 'Robot Framework Plugin'},
    {'max_version' : '1415', 'fixed_version' : '1422', 'fixed_display' : '1422.v06869826dd9b_', 'plugin' : 'Script Security Plugin'},
    {'max_version' : '13.10258', 'fixed_version' : '13.10259', 'fixed_display' : '13.10259.v80f407cb_03a_e', 'plugin' : 'Warnings Plugin'}
];

var app_info = vcf::jenkins::plugin::get_app_info(plugins:constraints);

vcf::jenkins::plugin::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE,
    flags:{'xss':TRUE}
);