1537 matches found
Whole-script approval in script-security vulnerable to SHA-1 collisions
script-security 1189.vbab7c8fd5fde and earlier stores whole-script approvals as the https://en.wikipedia.org/wiki/SHA-1SHA-1 hash of the approved script. SHA-1 no longer meets the security standards for producing a cryptographically secure message digest. script-security 1190.v65867aa47126 uses...
XXE vulnerability on agents in sourcemonitor
sourcemonitor 0.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control XML input files for the 'Publish SourceMonitor results' post-build step to have agent processes parse a crafted file that uses external entities for...
XXE vulnerability on agents in OSF Builder Suite : : XML Linter
OSF Builder Suite : : XML Linter 1.0.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control XML files that get processed by the 'OSF Builder Suite : : XML Linter' build step to have agent processes parse a crafted file tha...
CSRF protection for any URL can be bypassed in pipeline-input-step
pipeline-input-step 451.vf1aa4f405289 and earlier does not restrict or sanitize the optionally specified ID of the input step. This ID is used for the URLs that process user interactions for the given input step proceed or abort and is not correctly encoded. This allows attackers able to configur...
Content-Security-Policy protection for user content disabled by NeuVector Vulnerability Scanner
Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. NeuVector Vulnerability Scanner 1.20 and earlier globally disables the...
Content-Security-Policy protection for user content disabled by XFramium Builder
Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. XFramium Builder 1.0.22 and earlier globally disables the Content-Security-Poli...
Stored XSS vulnerability in DotCi
DotCi 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted commit notifications to the /githook/...
Missing permission checks in rundeck
rundeck 3.6.11 and earlier does not perform Run/Artifacts permission checks in multiple HTTP endpoints. This allows attackers with Item/Read permission to obtain information about build artifacts of a given job, if the optional Run/Artifacts permission is enabled. As of publication of this...
Stored XSS vulnerability in cavisson-ns-nd-integration
cavisson-ns-nd-integration 4.8.0.134 and earlier does not escape configuration options of the Execute NetStorm/NetCloud Test build step. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, the...
CSRF vulnerability in security-inspector
security-inspector 117.v6eecc36919c2 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to replace the generated report stored in a per-session cache and displayed to authorized users a...
CSRF vulnerability in external-monitor-job
external-monitor-job 191.v363d0d1efdf8 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to create runs of an external job. external-monitor-job 192.ve979ca8b3ccd requires POST request...
Path traversal vulnerability in deployer-framework
deployer-framework 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation. This allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. deployer-framework...
Missing permission check in coverity allows enumerating credentials IDs
coverity 1.11.4 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. As ...
Missing permission check in rpmsign-plugin allows listing workspace contents
rpmsign-plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A...
Missing permission check in files-found-trigger allows listing the Jenkins controller file system
files-found-trigger 1.5 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can be...
Missing hostname verification in git-client
git-client 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH. This lack of verification could be abused using a man-in-the-middle attack to intercept these connections. git-client 3.11.1 provides strategies for performing host key verificati...
Missing permission check in rhnpush-plugin allows listing workspace contents
rhnpush-plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A...
Reflected XSS vulnerability in lucene-search
lucene-search 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the search result page. This results in a reflected cross-site scripting XSS vulnerability. As of publication of this advisory, there is no fix. Learn why we announce this...
Non-constant time webhook signature comparison in github
github 1.34.4 and earlier does not use a constant-time comparison when checking whether the provided and computed webhook signatures are equal. This could potentially allow attackers to use statistical methods to obtain a valid webhook signature. github 1.34.5 uses a constant-time comparison when...
Missing permission check in buckminster
buckminster 1.1.1 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. A sequence of requests can be used to...
Stored XSS vulnerability in xfpanel
xfpanel 2.0.1 and earlier does not escape the job names used in tooltips. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix. Learn why we announce this...
Password stored in plain text by elasticsearch-query
elasticsearch-query 1.2 and earlier stores a password unencrypted in its global configuration file org.jenkinsci.plugins.elasticsearchquery.ElasticsearchQueryBuilder.xml on the Jenkins controller as part of its configuration. This password can be viewed by users with access to the Jenkins...
Stored XSS vulnerability in ec2-deployment-dashboard
ec2-deployment-dashboard 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with View/Configure permission. As of publication of this advisory, there is no fix. Learn why w...
CSRF vulnerability in matrix-reloaded
matrix-reloaded 1.1.3 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to rebuild previous matrix builds. As of publication of this advisory, there is no fix. Learn why we announce th...
CSRF vulnerability and missing permission checks in Recipe allow XXE
Recipe 1.2 and earlier does not perform a permission check in multiple HTTP endpoints. This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. As the plugin does not configure its XML parser to prevent XML external...
Incorrect permission check in requests allows viewing pending requests
requests 2.2.16 and earlier does not correctly perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to view the list of pending requests. NOTE: This is basically the same vulnerability as SECURITY-1995, whose fix was ineffective. requests 2.2.17...
Token stored in plain text by cisco-spark
cisco-spark 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file org.jenkinsci.plugins.spark.SparkNotifier.xml on the Jenkins controller as part of its configuration. These bearer tokens can be viewed by users with access to the Jenkins controller file system. As of...
Tokens stored in plain text by build-notifications
build-notifications 1.5.0 and earlier stores multiple tokens unencrypted in its global configuration files on the Jenkins controller as part of its configuration: Pushover Application Token in tools.devnull.jenkins.plugins.buildnotifications.PushoverNotifier.xml Slack Bot Token in...
CSRF vulnerability and missing permission checks in jianliao
jianliao 1.1 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL. Additionally, this form validation method does not require POST requests, resulting in...
Reflected XSS vulnerability in embeddable-build-status
embeddable-build-status 2.0.3 allows specifying a link query parameter that build status badges will link to, without restricting possible values. This results in a reflected cross-site scripting XSS vulnerability. embeddable-build-status 2.0.4 limits URLs to http and https protocols and correctl...
Path traversal vulnerability in embeddable-build-status
embeddable-build-status 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values. This results in a relative path traversal vulnerability, allowing attackers without Overall/Read permission to specify paths ...
Improper authorization in embeddable-build-status bypasses ViewStatus permission requirement
embeddable-build-status 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for "unprotected" status badge access. This allows attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or...
Reflected XSS vulnerability in nested-view
nested-view 1.20 through 1.25 both inclusive does not escape search parameters. This results in a reflected cross-site scripting XSS vulnerability. nested-view 1.26 escapes search parameters...
Multiple vulnerabilities in Windows Remote Command library in windows-slaves
windows-slaves 1.8 and earlier includes the Windows Remote Command library. It provides a general-purpose remote command execution capability that Jenkins uses to check if Java is available, and if not, to install it. This library has a buffer overflow vulnerability that may allow users able to...
Missing permission checks in Pipeline: Phoenix AutoTest allow enumerating credentials IDs
Pipeline: Phoenix AutoTest 1.3 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using anothe...
Stored XSS vulnerability in selected-tests-executor
selected-tests-executor 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix...
Arbitrary file read vulnerability in Pipeline: Phoenix AutoTest
Pipeline: Phoenix AutoTest 1.3 and earlier implements a Pipeline step ftp to upload files to an FTP server without limiting the source directory. This allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server...
Passwords stored in plain text by instant-messaging
instant-messaging provides a framework for plugins integrating Jenkins with instant messaging services. instant-messaging 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on instant-messaging on the Jenkins controller. These passwords...
Arbitrary file read vulnerability in kubernetes-cd
kubernetes-cd contributes the 'Kubernetes configuration kubeconfig' credential type. kubernetes-cd 2.3.1 and earlier allows users with Credentials/Create or Credentials/Update permission to read arbitrary files on the Jenkins controller by defining a 'From a file on the Jenkins master' Kubeconfig...
Stored XSS vulnerability in folder-auth
folder-auth 1.3 and earlier does not escape the names of roles shown on the configuration form. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission. folder-auth 1.4 escapes the names of roles shown on the configuration form...
Missing permission checks in kubernetes-cd allow enumerating credentials IDs
kubernetes-cd 2.3.1 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...
CSRF vulnerability and missing permission checks in release-helper
release-helper 1.3.3 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally, this form validation method does...
Stored XSS vulnerability in favorite
favorite 2.4.0 and earlier does not escape the names of jobs in the favorite column. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure or Item/Create permissions. favorite 2.4.1 escapes the names of jobs in the favorite column...
Stored XSS vulnerability in promoted-builds-simple
promoted-builds-simple 1.9 and earlier does not escape the name of custom promotion levels. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission. As of publication of this advisory, there is no fix. Learn why we announce this...
Sandbox bypass vulnerability in workflow-cps-global-lib
workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the same workspace directory for all checkouts of Pipeline libraries with the same name regardless of the SCM being used and the source of the library configuration. This allows attackers with Item/Configure permission to execute arbitrar...
CSRF vulnerability and missing permission check in SWAMP allows capturing credentials
SWAMP 1.2.6 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored i...
Password parameter default values exposed by pipeline-build-step
pipeline-build-step 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator. This allows attackers with Item/Read permission to retrieve the default password parameter value from jobs. pipeline-build-step 2.15.1 redacts...
CSRF vulnerability and missing permission check in scp
scp 1.8 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified username and password. Additionally, this form validation method does not...
Sensitive information disclosure in workflow-cps
workflow-cps 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds. This allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline. workflow-cps 2656.vf7ae7b75a457 does not allow...
Agent-to-controller security bypass in hashicorp-vault-plugin allows reading arbitrary files
hashicorp-vault-plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system. This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system. NOTE: This...