Missing permission checks in Pipeline: Phoenix AutoTest allow enumerating credentials IDs

Pipeline: Phoenix AutoTest 1.3 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using anothe...

Stored XSS vulnerability in favorite

favorite 2.4.0 and earlier does not escape the names of jobs in the favorite column. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions. favorite 2.4.1 escapes the names of jobs in the favorite column...

Passwords stored in plain text by dbCharts

dbCharts 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file hudson.plugins.dbcharts.DbChartPublisher.xml on the Jenkins controller as part of its configuration. These passwords can be viewed by users with access to the Jenkins controller file system. A...

Agent-to-controller security bypass in hashicorp-vault-plugin allows reading arbitrary files

hashicorp-vault-plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system. This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system. NOTE: This...

Stored XSS vulnerability in Team Views

Team Views 0.9.0 and earlier does not escape team names. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Read permission. As of publication of this advisory, there is no fix. Learn why we announce this...

Missing synchronization vulnerability in convertigo-mobile-platform allow to capture passwords

convertigo-mobile-platform 1.1 and earlier uses static fields to store job configuration information. This allows attackers with Item/Configure permission to capture passwords of the jobs that will be configured. As of publication of this advisory, there is no fix. Learn why we announce this...

Sandbox bypass vulnerability in workflow-cps-global-lib

workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create directories without canonicalization or sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially...

CSRF vulnerability and missing permission checks in checkmarx allow capturing credentials

checkmarx 2022.1.2 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

Missing permission checks in ssh-agent allow enumerating credentials IDs

ssh-agent 1.23 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. An...

Stored XSS vulnerability in badge

badge allows adding custom build badges with a custom description and optionally a link to a URL. badge 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge. This results in a stored cross-site scripting XSS vulnerability exploitable by...

Agent-to-controller security bypass in Debian Package Builder

Debian Package Builder 1.6.11 and earlier implements functionality that allows agent processes to invoke command-line git at an attacker-specified path on the controller. This allows attackers able to control agent processes to invoke arbitrary OS commands on the controller. As of publication of...

Path traversal vulnerability in subversion allows reading arbitrary files

subversion 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent. This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system. subversion 2.15.1 checks for the presence ...

Jenkins core bundles vulnerable version of the commons-httpclient library

Jenkins 2.314 and earlier, LTS 2.303.1 and earlier bundles a version of the commons-httpclient library with the vulnerability https://nvd.nist.gov/vuln/detail/CVE-2014-3577CVE-2014-3577 that incorrectly verified SSL/TLS certificates, making it susceptible to man-in-the-middle attacks. This librar...

RCE vulnerability in code-coverage-api

code-coverage-api 1.4.0 and earlier does not apply https://github.com/jenkinsci/jep/tree/master/jep/200JEP-200 deserialization protection to Java objects it deserializes from disk. This results in a remote code execution RCE vulnerability exploitable by attackers able to control agent processes...

CSRF vulnerabilities in requests

requests 2.2.12 and earlier does not require POST requests to request and apply changes, resulting in cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow attackers to create requests and/or have administrators apply pending requests, like renaming or deleting jobs, deleti...

Missing permission check in requests allows viewing pending requests

requests 2.2.6 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to view the list of pending requests. requests 2.2.7 requires Overall/Administer permission to view the list of pending requests. NOTE: The previous sentence...

XXE vulnerability in xcode-plugin

xcode-plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control the input files for the Xcode build step to have Jenkins parse a crafted Xcode Workspace File that uses external entities for extraction of secrets...

Missing permission check in electricflow allows scheduling builds

electricflow 1.1.21 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Item/Read permission to schedule builds of projects without having Item/Build permission. electricflow 1.1.22 requires Item/Build permission to schedule builds via its HTTP endpoint...

CSRF vulnerability and missing permission checks in dependency-track allow capturing credentials

dependency-track 3.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing "Secret text" credentials...

Passwords stored in plain text by jabber

jabber 1.41 and earlier stores passwords unencrypted in its global configuration file hudson.plugins.jabber.im.transport.JabberPublisher.xml on the Jenkins controller as part of its configuration. These passwords can be viewed by users with access to the Jenkins controller file system. jabber 1.4...

Stored XSS vulnerability in rest-list-parameter

rest-list-parameter 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. rest-list-parameter 1.3.1 no longer identifies a parameter using...

Missing permission check in Team Foundation Server allows enumerating credentials IDs

Team Foundation Server 5.157.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

CSRF vulnerability and missing permission check in Team Foundation Server allow capturing credentials

Team Foundation Server 5.157.1 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

Stored XSS vulnerability in repository-connector

repository-connector 2.0.2 and earlier does not escape parameter names and descriptions for past builds. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. repository-connector 2.0.3 escapes parameter names and descriptions whe...

Support bundles can include user session IDs in support-core

support-core 2.72 and earlier provides the serialized user authentication as part of the "About user basic authentication details only" information user.md. In some configurations, this can include the session ID of the user creating the support bundle. Attackers with access to support bundle...

XSS vulnerability in notification bar

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents typically shown after form submissions via Apply button. This results in a cross-site scripting XSS vulnerability exploitable by attackers able to influence notification bar contents. Jenkins...

Missing permission check for paths with specific prefix

Jenkins includes a static list of URLs that are always accessible even without Overall/Read permission, such as the login form. These URLs are excluded from an otherwise universal permission check. Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly compare requested URLs with...

Missing permission checks in chaos-monkey

chaos-monkey 0.3 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to generate load and to generate memory leaks. chaos-monkey 0.4 requires Overall/Administer permission to generate load and to generate memory leaks...

Missing permission check in mercurial

mercurial 2.11 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations. mercurial 2.12 performs permission checks when listing configured Mercurial installations...

Missing permission checks in azure-keyvault allow enumerating credentials IDs

azure-keyvault 2.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

Password stored in plain text by couchdb-statistics

couchdb-statistics 0.3 and earlier stores its server password unencrypted in its global configuration file org.jenkinsci.plugins.couchstats.CouchStatsConfig.xml on the Jenkins controller as part of its configuration. This password can be viewed by users with access to the Jenkins controller file...

Stored XSS vulnerability in description-column-plugin

description-column-plugin 1.3 and earlier does not escape the job description in the column tooltips. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. As of publication of this advisory, there is no fix...

Stored XSS vulnerability in clearcase-release

clearcase-release 0.3 and earlier does not escape the composite baseline in badge tooltip. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. As of publication of this advisory, there is no fix...

Arbitrary file write vulnerability in Storable Configs

Storable Configs allows storing copies of a job's config.xml file on the Jenkins controller with a user-specified file name. Storable Configs 1.0 and earlier does not restrict the user-specified file name, except that a .xml suffix is added if it's not already present. This allows attackers with...

Missing permission check in blueocean

Updated 2020-09-16: This entry previously misidentified the problematic behavior. The HTTP request itself is legitimate, but only authorized users should be able to perform it. blueocean 1.23.2 and earlier does not perform permission checks in several HTTP endpoints implementing connection tests...

XSS vulnerability in build-failure-analyzer

build-failure-analyzer 1.27.0 and earlier does not escape matching text in a form validation response. This results in a cross-site scripting XSS vulnerability exploitable by attackers able to provide console output for builds used to test build log indications. build-failure-analyzer 1.27.1...

Passwords stored in plain text by soapui-pro-functional-testing

soapui-pro-functional-testing 1.3 and earlier stores project passwords unencrypted in job config.xml files as part of its configuration. These project passwords can be viewed by attackers with Extended Read permission or access to the Jenkins controller file system. soapui-pro-functional-testing...

Stored XSS vulnerability in git-parameter

git-parameter 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. git-parameter 0.9.13 escapes the repository field on the 'Build with...

Reflected XSS vulnerability in JSGames

JSGames 0.2 and earlier evaluates part of a URL as code. This results in a reflected cross-site scripting XSS vulnerability. As of publication of this advisory, there is no fix...

Stored XSS vulnerability in upstream cause

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause. This results in a stored cross-site scripting XSS vulnerability exploitable by users with Job/Configure permission. Jenkins 2.245, LTS 2.235.2 escapes the job display...

Stored XSS vulnerability in 'keep forever' badge icons

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip. This results in a stored cross-site scripting XSS vulnerability exploitable by users able to configure job names. As job names do not generally support the character set...

Stored XSS vulnerability in matrix-auth

matrix-auth 2.6.1 and earlier does not escape user names shown in the permission table. This results in a stored cross-site scripting XSS vulnerability. When using project-based matrix authorization, this vulnerability can be exploited by a user with Job/Configure or Agent/Configure permission,...

Stored XSS vulnerability in echarts-api

echarts-api 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart. This results in a stored cross-site scripting XSS vulnerability that can be exploited by users with Run/Update permission. echarts-api 4.7.0-4 escapes the display name...

Missing SSH host key validation in ec2

ec2 1.50.1 and earlier does not use SSH host key validation when connecting to agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. ec2 1.50.2 provides strategies for performing host key validation for administrators to...

Credentials stored in plain text by copr

copr 0.3 and earlier stores credentials unencrypted in job config.xml files as part of its configuration. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system. copr 0.6.1 stores these credentials encrypted. This change is effective...

RCE vulnerability in pipeline-aws

pipeline-aws 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution RCE vulnerability exploitable by users able to provide YAML input files to pipeline-aws's build steps. pipeline-aws 1.41 configures its YAML...

Sandbox bypass vulnerability in script-security

Sandbox protection in script-security 1.70 and earlier can be circumvented through: Crafted constructor calls and bodies due to an incomplete fix of SECURITY-582 Crafted method calls on objects that implement GroovyInterceptable This allows attackers able to specify and run sandboxed scripts to...

XXE vulnerability in rundeck

rundeck 3.6.6 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows a user with Overall/Read access to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or...

RCE vulnerability in radargun

radargun 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution vulnerability exploitable by users able to configure radargun's build step. radargun 1.8 configures its YAML parser to only instantiate safe types...

Password stored in plain text by applatix

applatix 1.1 and earlier stores the Applatix password unencrypted in job config.xml files as part of its configuration. This credential can be viewed by users with Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, there is no fix...