CSRF vulnerability in alauda-kubernetes-support

alauda-kubernetes-support 2.3.0 and earlier does not require POST requests on a connection test method, resulting in a CSRF vulnerability. This allows attackers to have Jenkins connect to Kubernetes-related paths on an attacker-specified web server using attacker-specified credentials IDs obtaine...

Stored XSS vulnerability in mission-control-view

mission-control-view 0.9.16 and earlier does not escape job display names and build names in the view it provides. This results in a stored cross-site scripting vulnerability that can be exploited by users able to change these properties. As of publication of this advisory, there is no fix...

SSL/TLS certificate validation globally and unconditionally disabled by websphere-deployer

websphere-deployer 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM, or specify a new Java keystore from a file stored on the Jenkins controller filesystem. As of publication of this advisory, ther...

Users with Overall/Read access can enumerate credential IDs in teamconcert

teamconcert 1.3.0 and earlier provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those can be...

redgate-sql-ci stores credentials in plain text

redgate-sql-ci 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins controller as part of its build step configuration. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system. redgate-sql-ci 2.0.4...

qmetry-for-jira-test-management shows plain text password in configuration form

qmetry-for-jira-test-management stores a credential as part of its post-build step configuration. While the password is stored encrypted on disk since qmetry-for-jira-test-management 1.13, it is transmitted in plain text as part of the configuration form. This can result in exposure of the passwo...

anchore-container-scanner stored credentials in plain text

anchore-container-scanner stored an Anchore.io service password unencrypted in job config.xml files as part of its configuration. This credential could be viewed by users with Extended Read permission or access to the Jenkins controller file system. As the affected functionality has been...

google-compute-engine did not verify SSH host keys

google-compute-engine did not use SSH host key verification when connecting to VMs launched by the plugin. This lack of verification could be abused by a MitM attacker to intercept these connections to attacker-specified build agents without warning. google-compute-engine now verifies SSH host ke...

support-core allowed users with Overall/Read permission to delete arbitrary files

support-core did not validate the paths submitted for the "Delete Support Bundles" feature. This allowed users to delete arbitrary files on the Jenkins controller file system accessible to the OS user account running Jenkins. Additionally, this endpoint did not perform a permission check, allowin...

CSRF vulnerability in google-compute-engine allowed provisioning agents

google-compute-engine did not require POST requests on an API endpoint. This CSRF vulnerability allowed attackers to provision new agents. google-compute-engine now requires POST requests for this API endpoint...

qmetry-for-jira-test-management stored credentials in plain text

qmetry-for-jira-test-management stored credentials unencrypted in job config.xml files on the Jenkins controller as part of its post-build step configuration. This credential could be viewed by users with Extended Read permission or access to the Jenkins controller file system...

Missing permission check in dynatrace-dashboard

dynatrace-dashboard does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password. As of publication of this advisory,...

Users with Overall/Read access could enumerate credential IDs in kubernetes-ci

kubernetes-ci provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those can be used as part of a...

dynatrace-dashboard stored credentials in plain text

dynatrace-dashboard stored a credential unencrypted in its global configuration file com.dynatrace.jenkins.dashboard.TAGlobalConfiguration.xml on the Jenkins controller. This credential could be viewed by users with access to the Jenkins controller file system. dynatrace-dashboard now stores this...

XXE vulnerability in fireline

fireline accepts XML for part of its configuration. It does not configure the XML parser to prevent XML external entity XXE attacks. A form validation method that accepts XML does not perform permission checks. This allows users with Overall/Read permission to have Jenkins parse a crafted XML fil...

bumblebee unconditionally disabled SSL/TLS certificate validation

bumblebee unconditionally disabled SSL/TLS certificate validation for connections to the HP ALM service. bumblebee no longer does that. Instead, it now allows users to opt out of certificate validation...

fortify-on-demand-uploader stores credentials in plain text

fortify-on-demand-uploader stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory there is no fix...

CSRF vulnerability and missing permission check in oracle-cloud-infrastructure-compute-classic

oracle-cloud-infrastructure-compute-classic does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password. Additionally,...

Sandbox bypass vulnerability in script-security

Sandbox protection in script-security could be circumvented through default parameter expressions in constructors. This allowed attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins controller JVM. These expressions are now subject to sandbox...

Stored XSS vulnerability in SCM tag action tooltip

Jenkins did not escape the tag name on the tooltip for tag actions shown in the build history. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the SCM tag name for these actions. Jenkins now escapes the SCM tag action...

Stored XSS vulnerability in expandable textbox form control

Jenkins form controls include an expandable textbox that can transform from a single-line text box to a multi-line text area. The implementation of this transformation interpreted the text content of the form field as HTML. This resulted in a cross-site scripting vulnerability exploitable by...

XSS vulnerability in combobox form control

Jenkins interpreted items added to f:combobox form controls as HTML. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the contents of f:combobox form controls. Jenkins no longer interprets items added to a combobox as HTML. NOTE ====== This might be a...

aqua-security-scanner showed plain text password in configuration form

aqua-security-scanner stores a password in its global Jenkins configuration. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting...

datatheorem-mobile-app-security stored credentials in plain text

datatheorem-mobile-app-security stored a proxy password unencrypted in job config.xml files on the Jenkins controller. This password could be viewed by users with Extended Read permission, or access to the Jenkins controller file system. datatheorem-mobile-app-security now stores the proxy passwo...

inedo-buildmaster showed plain text password in configuration form

inedo-buildmaster stores a service password in its global Jenkins configuration. While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting...

Script sandbox bypass vulnerability in Kubernetes Pipeline - Kubernetes Steps Plugin

Kubernetes Pipeline - Kubernetes Steps Plugin defines a custom list of pre-approved signatures for all scripts protected by the Script Security sandbox. This custom list of pre-approved signatures allows the use of methods that can be used to bypass Script Security sandbox protection. This result...

System command execution vulnerability in git-client

git-client accepts user-specified values as argument to an invocation of git ls-remote to validate the existence of a Git repository at the specified URL. This was implemented in a way that allowed attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins...

Sandbox Bypass in splunk-devops

splunk-devops has a form validation HTTP endpoint used to validate a user-submitted Groovy script through compilation, which was not subject to sandbox protection. This allowed attackers with Overall/Read access to execute arbitrary code on the Jenkins controller by applying AST transforming...

eggplant-plugin stores credentials in plain text

eggplant-plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. As of publication of this advisory, there is no fix...

Reflected XSS vulnerability in jenkinswalldisplay

jenkinswalldisplay does not properly escape the customTheme query parameter, resulting in a reflected cross-site scripting vulnerability. As of publication of this advisory, there is no fix...

CSRF vulnerability and missing permission check in jclouds-jenkins allowed capturing credentials

jclouds-jenkins did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

configuration-as-code did not mask proxy credentials

configuration-as-code provides a custom configurator for the Jenkins proxy configuration. This feature did not mask the password for logging or encrypt it in the export. configuration-as-code 1.20 and newer mask the Jenkins proxy password when logged and only store it encrypted in the export...

configuration-as-code failed to mask secrets in system log messages

configuration-as-code logs the changes it applies to the Jenkins system log. Secrets such as passwords should be masked i.e. replaced with asterisks in that log to prevent accidental disclosure. Between configuration-as-code 0.8-alpha and 1.0, log messages contained values if the values were...

configuration-as-code allowed users without Overall/Administer permission to access documentation

configuration-as-code provides a generated schema and reference documentation for the configuration options supported on the current Jenkins instance. These URLs did not perform additional permission checks, resulting in their content being available to users with Overall/Read access. This includ...

CSRF protection tokens did not expire

By default, CSRF tokens in Jenkins only checked user authentication and IP address. This allowed attackers able to obtain a CSRF token for another user to implement CSRF attacks as long as the victim's IP address remained unchanged. CSRF tokens will now also check the web session ID to confirm th...

Users with Overall/Read access could enumerate credential IDs in docker-plugin

docker-plugin provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use. This functionality did not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of ...

CSRF vulnerability and missing permission check in jx-resources

jx-resources did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified Kubernetes server and obtain information about an attacker-specified namespace. Doing so might also leak service...

XSS vulnerability in build metadata contributed by electricflow

The plugin adds metadata displayed on build pages during its operations. Any user content was not escaped, resulting in a cross-site scripting vulnerability allowing users with Job/Configure permission, or attackers controlling API responses received from ElectricFlow to render arbitrary HTML and...

CSRF vulnerability in artifactory

artifactory implements a number of API endpoints allowing users to trigger various actions related to releasing and promotion. These endpoints do not require POST requests, resulting in a cross-site request forgery vulnerability. As of publication of this advisory, no release containing a fix is...

Unsafe entry in Script Security list of approved signatures in workflow-remote-loader

workflow-remote-loader provides a custom list of pre-approved signatures for Script Security. Those entries apply to all scripts with sandbox protection, such as Pipeline. One entry provided here was unsafe, as it allowed invoking arbitrary methods, bypassing sandbox protection. The unsafe...

influxdb stored credentials in plain text

influxdb stored target passwords unencrypted in its global configuration file on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. influxdb now stores its passwords encrypted...

CSRF vulnerability in warnings-ng

warnings-ng did not require that requests sent to the endpoint used to reset warning counts use POST. This resulted in a cross-site request forgery vulnerability that allows attackers to reset warning counts for future builds. warnings-ng now requires that these requests be sent via POST...

Missing permission check allowed obtaining limited information about system configuration in pam-auth

A missing permission check in pam-auth allowed users with Overall/Read permission to invoke a form validation method to obtain limited information about the file /etc/shadow on systems with that file present, as well as the system user the Jenkins process is running as. Depending on configuration...

Certificate file read vulnerability in credentials

Credentials Plugin allowed the creation of Certificate credentials from a PKCS12 file on the Jenkins controller. Users with permission to create or update credentials could use the associated form validation to confirm the existence of files with an attacker-specified path. Additionally, they cou...

CSRF vulnerability and missing permission checks in gitlab-plugin allowed capturing credentials

gitlab-plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkin...

azure-publishersettings-credentials stored credentials in plain text

azure-publishersettings-credentials stored the service management certificate unencrypted in credentials.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. azure-publishersettings-credentials has been deprecated...

Sandbox bypass in ontrack

ontrack supports sandboxed Groovy expressions. Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script. This allowed users able to control the plugin’s job-specific configuration to bypass the sandbox protection and...

CSRF vulnerability and missing permission check in deployit-plugin

A missing permission check in a form validation method in deployit-plugin allows users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified credentials. Additionally, the form validation method does not require POST requests, resulting...

sametime stores credentials in plain text

sametime stores credentials unencrypted in its global configuration file hudson.plugins.sametime.im.transport.SametimePublisher.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

kmap-jenkins stores credentials in plain text

kmap-jenkins stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...