OS command execution vulnerabilities in Pipeline-related plugins

Multiple Pipeline-related plugins that perform on-controller SCM checkouts reuse the same workspace directory for checkouts of distinct SCMs in some contexts. - Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file...

Password parameter default values exposed by pipeline-build-step

pipeline-build-step 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator. This allows attackers with Item/Read permission to retrieve the default password parameter value from jobs. pipeline-build-step 2.15.1 redacts...

Stored XSS vulnerability in agent-server-parameter

agent-server-parameter 1.0 and earlier does not escape parameter names of agent server parameters. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. agent-server-parameter 1.1 escapes parameter names of agent server parameters...

CSRF vulnerability and missing permission check in scp

scp 1.8 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified username and password. Additionally, this form validation method does not...

Stored XSS vulnerability in custom-checkbox-parameter

custom-checkbox-parameter 1.1 and earlier does not escape parameter names of custom checkbox parameters. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. custom-checkbox-parameter 1.2 escapes parameter names of custom checkbo...

Missing synchronization vulnerability in convertigo-mobile-platform allow to capture passwords

convertigo-mobile-platform 1.1 and earlier uses static fields to store job configuration information. This allows attackers with Item/Configure permission to capture passwords of the jobs that will be configured. As of publication of this advisory, there is no fix. Learn why we announce this...

Sandbox bypass vulnerability in workflow-cps-global-lib

workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted...

CSRF vulnerability and missing permission check in autonomiq

autonomiq 1.15 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally, this HTTP endpoint does not require POST requests, resulting...

CSRF vulnerability and missing permission checks in dbCharts

dbCharts 0.5.2 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials. Additionally, this method allows attackers to...

Vulnerabilities in multiple Pipeline-related plugins allow reading arbitrary files on the controller

Multiple Pipeline-related plugins follow symbolic links or do not limit path names, resulting in arbitrary file read vulnerabilities: - Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading...

Sensitive information disclosure in workflow-cps

workflow-cps 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds. This allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline. workflow-cps 2656.vf7ae7b75a457 does not allow...

Sandbox bypass vulnerability in workflow-cps-global-lib

workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create directories without canonicalization or sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially...

Agent-to-controller security bypass in hashicorp-vault-plugin allows reading arbitrary files

hashicorp-vault-plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system. This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system. NOTE: This...

DoS vulnerability in bundled XStream library

Jenkins 2.333 and earlier, LTS 2.319.2 and earlier is affected by the XStream library's vulnerability https://x-stream.github.io/CVE-2021-43859.htmlCVE-2021-43859. This library is used by Jenkins to serialize and deserialize various XML files, like global and job config.xml, build.xml, and numero...

CSRF vulnerability in batch task

batch task 1.19 and earlier does not require POST requests for several HTTP endpoints, resulting in cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow attackers with Overall/Read access to retrieve logs, build or delete a batch task. As of publication of this advisory,...

CSRF vulnerability in build triggers

Jenkins 2.329 and earlier, LTS 2.319.1 and earlier does not require POST requests for the HTTP endpoint handling manual build requests when no security realm is set, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to trigger build of job without...

CSRF vulnerability and missing permission checks in mailer

mailer 391.ve4a38c1bcf4b and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname. Additionally, this form validation method does n...

Missing permission check in credentials-binding allows validating secret file credentials IDs

credentials-binding 1.27 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it's a zip file. credentials-binding 1.27.1 performs...

Access key stored in plain text by metrics

metrics 4.0.2.8 and earlier stores access keys unencrypted in its global configuration file jenkins.metrics.api.MetricsAccessKey.xml on the Jenkins controller as part of its configuration. This access key can be viewed by users with access to the Jenkins controller file system. metrics 4.0.2.8.1...

OS command execution vulnerability in docker-commons

docker-commons 1.17 and earlier does not sanitize the name of an image or a tag. This results in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository. docker-commons 1.18...

Missing permission checks in cloudbees-bitbucket-branch-source allow enumerating credentials IDs

cloudbees-bitbucket-branch-source 737.vdf9dc06105be and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the...

CSRF vulnerability in cloudbees-bitbucket-branch-source allows capturing credentials

cloudbees-bitbucket-branch-source 737.vdf9dc06105be and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified...

Missing permission checks in ssh-agent allow enumerating credentials IDs

ssh-agent 1.23 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability. An...

Stored XSS vulnerability in Publish Over SSH

Publish Over SSH 1.22 and earlier does not escape the SSH server name. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Administer permission. As of publication of this advisory, there is no fix. Learn why we announce this...

Path traversal vulnerability in Publish Over SSH

Publish Over SSH 1.22 and earlier performs a validation of the file name specifying whether it is present or not. This results in a path traversal vulnerability allowing attackers with Item/Configure permission to discover the name of the Jenkins controller files. As of publication of this...

User passwords transmitted in plain text by active-directory

active-directory implements two separate modes: integration with ADSI on Windows, and an OS agnostic LDAP-based mode. active-directory 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers unless it is configured to use the OS...

Agent-to-controller security bypass in Debian Package Builder

Debian Package Builder 1.6.11 and earlier implements functionality that allows agent processes to invoke command-line git at an attacker-specified path on the controller. This allows attackers able to control agent processes to invoke arbitrary OS commands on the controller. As of publication of...

Stored XSS vulnerability in badge

badge allows adding custom build badges with a custom description and optionally a link to a URL. badge 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge. This results in a stored cross-site scripting XSS vulnerability exploitable by...

Agent-to-controller security bypass in conjur-credentials allows retrieving all credentials

conjur-credentials 1.0.9 and earlier implements functionality that allows agent processes to obtain all username/password credentials Credentials Plugin stored on the Jenkins controller. This allows attackers able to control agent processes to retrieve those credentials. As of publication of this...

Improper credentials masking in hashicorp-vault-plugin

Pipelines display commands executed in their Pipeline step descriptions and their output in build logs. To mask sensitive output, Pipeline: Groovy Plugin 2.84 and earlier specified an allowlist of known non-sensitive variables and masked everything else. This caused problems, so Pipeline: Groovy...

Agent-to-controller security bypass in conjur-credentials allows decrypting secrets

conjur-credentials 1.0.9 and earlier implements functionality that allows agent processes to obtain the plain text of any attacker-provided encrypted secret. This allows attackers able to control agent processes to decrypt secrets stored in Jenkins obtained through another method. As of publicati...

Stored XSS vulnerability in matrix-project

matrix-project 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Agent/Configure permission. matrix-project 1.20 escapes HTML metacharacters in node an...

Path traversal vulnerability in warnings-ng

warnings-ng 9.10.2 and earlier does not restrict the name of a file when configuring a custom ID. This allows attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system. warnings-ng 9.10.3 checks for the presence of...

CSRF vulnerability and missing permission checks in Publish Over SSH

Publish Over SSH 1.22 and earlier does not perform permission checks in methods implementing connection tests. This allows attackers with Overall/Read access to connect to an attacker-specified SSH server using attacker-specified credentials. Additionally, these connection tests methods do not...

Non-constant time token comparison in configuration-as-code

configuration-as-code 1.55 and earlier does not use a constant-time comparison when checking whether two authentication tokens are equal. This could potentially allow attackers to use statistical methods to obtain a valid authentication token. configuration-as-code 1.55.1 now uses a constant-time...

Password stored in plain text by Publish Over SSH

Publish Over SSH 1.22 and earlier stores password unencrypted in its global configuration file jenkins.plugins.publishoverssh.BapSshPublisherPlugin.xml on the Jenkins controller as part of its configuration. This password can be viewed by users with access to the Jenkins controller file system. A...

Stored XSS vulnerability in uno-choice

uno-choice 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. uno-choice 2.5.7 escapes references to parameter names...

XXE vulnerability in dependency-check-jenkins-plugin

dependency-check-jenkins-plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins...

Agent-to-controller security bypass in Squash TM Publisher (Squash4Jenkins) allows writing arbitrary files

Squash TM Publisher Squash4Jenkins 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input. This allows attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JS...

XXE vulnerability in pom2config

pom2config 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or...

XXE vulnerability in performance

performance 3.20 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted XML report file that uses external entities for extraction of secrets from the Jenkins controller or...

Stored XSS vulnerability in scriptler

scriptler 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create Scriptler scripts. scriptler 3.4 escapes the name of scripts on the UI when asking...

Agent-to-controller access control allows reading/writing most content of build directories

Agents are allowed some limited access to files on the Jenkins controller file system. The directories agents are allowed to access in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier include the directories storing build-related information, intended to allow agents to store build-related...

Path traversal vulnerability in subversion allows reading arbitrary files

subversion 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent. This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system. subversion 2.15.1 checks for the presence ...

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary...

Agent-to-controller access control allowed writing to sensitive directory used by Pipeline: Shared Groovy Libraries Plugin

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs. This directory is used by the Pipeline: Shared Groovy Libraries Plugin to store copies of shared libraries. This allows attackers...

Jenkins core bundles vulnerable version of the commons-httpclient library

Jenkins 2.314 and earlier, LTS 2.303.1 and earlier bundles a version of the commons-httpclient library with the vulnerability https://nvd.nist.gov/vuln/detail/CVE-2014-3577CVE-2014-3577 that incorrectly verified SSL/TLS certificates, making it susceptible to man-in-the-middle attacks. This librar...

Path traversal vulnerability on Windows

The file browser for workspaces, archived artifacts, and userContent/ in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows. This results in a path traversal vulnerability allowing attackers with Overall/Read permission Windows controller o...

Stored XSS vulnerability in git

git 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted commit notifications to the...

Improper handling of equivalent directory names on Windows

Jenkins stores jobs and other entities on disk using their name shown on the UI as file and folder names. On Windows, when specifying a file or folder with a trailing dot character example., the file or folder will be treated as if that character was not present example. As both are legal names f...