XSS vulnerability in ci-with-toad-edge

ci-with-toad-edge 2.3 and earlier uses a patched fork of an old version of the file browser for workspaces, archived artifacts, and userContent/ from Jenkins core DirectoryBrowserSupport to serve reports. This fork removes the Content-Security-Policy header functionality introduced for SECURITY-9...

Missing permission check in ci-with-toad-edge

ci-with-toad-edge 2.3 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. ci-with-toad-edge 2.4 requires...

Client Secret stored in plain text by gitlab-oauth

gitlab-oauth 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration. This client secret can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is...

Personal tokens stored in plain text by incapptic connect uploader

incapptic connect uploader 1.15 and earlier stores personal tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication ...

CSRF vulnerability and missing permission checks in aws-credentials

aws-credentials 189.v3551d5642995 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token. Additionally, this form validation method does not require...

Sensitive parameter values captured in build metadata files by parameterized-trigger

parameterized-trigger 2.43 and earlier captures environment variables passed to builds triggered using parameterized-trigger, including password parameter values, in their build.xml files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file...

Missing permission checks in kubernetes-cd allow enumerating credentials IDs

kubernetes-cd 2.3.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Stored XSS vulnerability in generic-webhook-trigger

generic-webhook-trigger 1.81 and earlier does not escape the build cause for the webhook. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds using the webhook. generic-webhook-trigger 1.82 escapes the build cause when displayed on the U...

Agent-to-controller security bypass in hashicorp-vault-plugin

hashicorp-vault-plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent. This allows attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key. The functionality that allow agen...

Missing permission check in conjur-credentials allows enumerating credentials IDs

conjur-credentials 1.0.11 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Stored XSS vulnerability in Team Views

Team Views 0.9.0 and earlier does not escape team names. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Read permission. As of publication of this advisory, there is no fix. Learn why we announce this...

Sensitive data stored in plain text by support-core

support-core has a feature to redact potentially sensitive information in the support bundle. support-core 2.79 and earlier does not redact some sensitive information in the support bundle. This sensitive information can be viewed by anyone with access to the bundle. support-core 2.79.1 adds a li...

Open redirect vulnerability in gitlab-oauth

gitlab-oauth 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts and redirects users to that URL when the user has finished logging in. This allows attackers with access to Jenkins to craft a URL that will redirect users to a...

CSRF vulnerability and missing permission checks in Chef Sinatra allow XXE

Chef Sinatra 1.20 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse the response as XML. As the plugin does not configure...

Missing permission check in credentials-binding allows validating secret file credentials IDs

credentials-binding 1.27 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file. credentials-binding 1.27.1 performs...

Path traversal vulnerability in Publish Over SSH

Publish Over SSH 1.22 and earlier performs a validation of the file name specifying whether it is present or not. This results in a path traversal vulnerability allowing attackers with Item/Configure permission to discover the name of the Jenkins controller files. As of publication of this...

Password stored in plain text by Publish Over SSH

Publish Over SSH 1.22 and earlier stores password unencrypted in its global configuration file jenkins.plugins.publishoverssh.BapSshPublisherPlugin.xml on the Jenkins controller as part of its configuration. This password can be viewed by users with access to the Jenkins controller file system. A...

XXE vulnerability in pom2config

pom2config 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or...

Agent-to-controller security bypass in Squash TM Publisher (Squash4Jenkins) allows writing arbitrary files

Squash TM Publisher Squash4Jenkins 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input. This allows attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JS...

Jenkins core bundles vulnerable version of the commons-httpclient library

Jenkins 2.314 and earlier, LTS 2.303.1 and earlier bundles a version of the commons-httpclient library with the vulnerability https://nvd.nist.gov/vuln/detail/CVE-2014-3577CVE-2014-3577 that incorrectly verified SSL/TLS certificates, making it susceptible to man-in-the-middle attacks. This librar...

Stored XSS vulnerability in git

git 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted commit notifications to the...

RCE vulnerability in code-coverage-api

code-coverage-api 1.4.0 and earlier does not apply https://github.com/jenkinsci/jep/tree/master/jep/200JEP-200 deserialization protection to Java objects it deserializes from disk. This results in a remote code execution RCE vulnerability exploitable by attackers able to control agent processes...

Missing permission check in requests allows viewing pending requests

requests 2.2.6 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to view the list of pending requests. requests 2.2.7 requires Overall/Administer permission to view the list of pending requests. NOTE: The previous sentence...

XXE vulnerability in seleniumhtmlreport

seleniumhtmlreport 1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with the ability to control the report files parsed using this plugin to have Jenkins parse a crafted report file that uses external entities for extraction of...

XXE vulnerability in generic-webhook-trigger

generic-webhook-trigger 1.72 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with the ability to call webhooks configured to extract parameters using XPath to have Jenkins parse a crafted XML request body that uses external entities...

Stored XSS vulnerability in scriptler

scriptler 3.1 and earlier does not escape script content. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Scriptler/Configure permission. scriptler 3.2 escapes script content...

Missing permission checks allow enumerating credentials IDs in kubernetes-cli

kubernetes-cli 1.10.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Reflected XSS vulnerability in kiuwanJenkinsPlugin

kiuwanJenkinsPlugin 1.6.0 and earlier does not escape output that can indirectly be controlled through query parameters in an error message for a form validation endpoint. This results in a reflected cross-site scripting XSS vulnerability. NOTE: Only older releases of Jenkins are affected by this...

Stored XSS vulnerability in dashboard-view

dashboard-view 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with View/Configure permission. dashboard-view 2.16 does not render unsafe URLs. As part of this fix, the property...

XXE vulnerability in xcode-plugin

xcode-plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the input files for the Xcode build step to have Jenkins parse a crafted Xcode Workspace File that uses external entities for extraction of secrets...

Missing permission check in electricflow allows scheduling builds

electricflow 1.1.21 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Item/Read permission to schedule builds of projects without having Item/Build permission. electricflow 1.1.22 requires Item/Build permission to schedule builds via its HTTP endpoint...

CSRF vulnerability and missing permission checks in hp-application-automation-tools-plugin

hp-application-automation-tools-plugin 6.7 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to connect to attacker-specified URLs using attacker-specified username and password. Additionally, these form...

CSRF vulnerability in promoted-builds

promoted-builds 3.9 and earlier does not require POST requests for HTTP endpoints implementing promotion regular, forced, and re-execute, resulting in cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow attackers to promote builds. promoted-builds 3.9.1 requires POST...

SSL/TLS certificate validation unconditionally disabled by hp-application-automation-tools-plugin

hp-application-automation-tools-plugin 6.7 and earlier unconditionally disables SSL/TLS certificate validation for connections to Service Virtualization servers. hp-application-automation-tools-plugin 6.8 no longer disables SSL/TLS certificate validation unconditionally by default. It provides an...

Missing permission check in Team Foundation Server allows enumerating credentials IDs

Team Foundation Server 5.157.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

CSRF vulnerability and missing permission checks in dependency-track allow capturing credentials

dependency-track 3.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing "Secret text" credentials...

Stored XSS vulnerability in rest-list-parameter

rest-list-parameter 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. rest-list-parameter 1.3.1 no longer identifies a parameter using...

Support bundles can include user session IDs in support-core

support-core 2.72 and earlier provides the serialized user authentication as part of the "About user basic authentication details only" information user.md. In some configurations, this can include the session ID of the user creating the support bundle. Attackers with access to support bundle...

Stored XSS vulnerability in repository-connector

repository-connector 2.0.2 and earlier does not escape parameter names and descriptions for past builds. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. repository-connector 2.0.3 escapes parameter names and descriptions whe...

XSS vulnerability in claim

claim 2.18.1 and earlier does not escape the user display name shown in claims. This results in a cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins. NOTE: Everyone...

CSRF vulnerability in claim

claim 2.18.1 and earlier does not require POST requests for the form submission endpoint assigning claims, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to change claims. claim 2.18.2 requires POST requests for the affected HTTP endpoint...

Stored XSS vulnerability in artifact-repository-parameter

artifact-repository-parameter 1.0.0 and earlier does not escape parameter names and descriptions. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. artifact-repository-parameter 1.0.1 escapes parameter names and descriptions...

XSS vulnerability in notification bar

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents typically shown after form submissions via Apply button. This results in a cross-site scripting XSS vulnerability exploitable by attackers able to influence notification bar contents. Jenkins...

Stored XSS vulnerability in button labels

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI. This results in a cross-site scripting vulnerability exploitable by attackers with the ability to control button labels. An example of buttons with a user-controlled label are the buttons of the...

Missing permission check for paths with specific prefix

Jenkins includes a static list of URLs that are always accessible even without Overall/Read permission, such as the login form. These URLs are excluded from an otherwise universal permission check. Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly compare requested URLs with...

Credentials stored in plain text by bumblebee

bumblebee 4.1.5 and earlier stores credentials unencrypted in its global configuration file com.agiletestware.bumblebee.BumblebeeGlobalConfig.xml on the Jenkins controller as part of its configuration. These credentials can be viewed by users with access to the Jenkins controller file system...

CSRF vulnerability in shelve-project-plugin

shelve-project-plugin 3.0 and earlier does not require POST requests for HTTP endpoints, resulting in cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow attackers to shelve, unshelve, or delete a project. shelve-project-plugin 3.1 requires POST requests for the affected...

Missing permission checks in chaos-monkey

chaos-monkey 0.4 and earlier does not perform permission checks in an HTTP endpoint. This allows attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions. chaos-monkey 0.4.1 requires Overall/Administer permission to access the Chaos Monkey page and ...

XXE vulnerability in mercurial

mercurial 2.11 and earlier does not configure its XML changelog parser to prevent XML external entity XXE attacks. This allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controlle...

Missing permission check in kubernetes allows enumerating credentials IDs

kubernetes 1.27.3 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. A...