Headline
CVE-2022-25187: Jenkins Security Advisory 2022-02-15
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.
This advisory announces vulnerabilities in the following Jenkins deliverables:
- Agent Server Parameter Plugin
- autonomiq Plugin
- Checkmarx Plugin
- Conjur Secrets Plugin
- Convertigo Mobile Platform Plugin
- Custom Checkbox Parameter Plugin
- dbCharts Plugin
- Doktor Plugin
- Fortify Plugin
- Generic Webhook Trigger Plugin
- GitLab Authentication Plugin
- HashiCorp Vault Plugin
- HashiCorp Vault Plugin
- Pipeline: Build Step Plugin
- Pipeline: Deprecated Groovy Libraries Plugin
- Pipeline: Groovy Plugin
- Pipeline: Multibranch Plugin
- Promoted Builds (Simple) Plugin
- SCP publisher Plugin
- Chef Sinatra Plugin
- Snow Commander Plugin
- Support Core Plugin
- SWAMP Plugin
- Team Views Plugin
Descriptions****OS command execution vulnerabilities in Pipeline-related plugins
SECURITY-2463 / CVE-2022-25173 (Pipeline: Groovy Plugin), CVE-2022-25174 (Pipeline: Shared Groovy Libraries), CVE-2022-25175 (Pipeline: Multibranch)
Severity (CVSS): High
Affected plugins: workflow-cps , workflow-cps-global-lib , workflow-multibranch
Description:
Multiple Pipeline-related plugins that perform on-controller SCM checkouts reuse the same workspace directory for checkouts of distinct SCMs in some contexts.
Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines.
Pipeline: Shared Groovy Libraries 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries.
Pipeline: Multibranch 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step.
This allows attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Affected plugins have been updated to address these issues:
Pipeline: Groovy Plugin 2656.vf7a_e7b_75a_457 uses distinct checkout directories per SCM when reading the script file (typically Jenkinsfile) for Pipelines.
Pipeline: Shared Groovy Libraries 561.va_ce0de3c2d69 uses distinct checkout directories per SCM for Pipeline libraries.
Pipeline: Multibranch 707.v71c3f0a_6ccdb_ uses distinct checkout directories per SCM for the readTrusted step.
Vulnerabilities in multiple Pipeline-related plugins allow reading arbitrary files on the controller
SECURITY-2613 / CVE-2022-25176 (Pipeline: Groovy Plugin), CVE-2022-25177 (Pipeline: Shared Groovy Libraries), CVE-2022-25178 (Pipeline: Shared Groovy Libraries), CVE-2022-25179 (Pipeline: Multibranch)
Severity (CVSS): Medium
Affected plugins: workflow-cps , workflow-cps-global-lib , workflow-multibranch
Description:
Multiple Pipeline-related plugins follow symbolic links or do not limit path names, resulting in arbitrary file read vulnerabilities:
Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines (originally reported as SECURITY-2595).
Pipeline: Shared Groovy Libraries 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step (originally reported as SECURITY-2479).
Pipeline: Shared Groovy Libraries 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step (originally reported as SECURITY-2476).
Pipeline: Multibranch 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step (originally reported as SECURITY-2491).
This allows attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.
Affected plugins have been updated to address these issues:
Pipeline: Groovy Plugin 2656.vf7a_e7b_75a_457 checks that the script file for Pipelines is inside of the checkout directory for the configured SCM.
Pipeline: Shared Groovy Libraries 561.va_ce0de3c2d69 checks that any resources retrieved by the libraryResource step are contained within the expected Pipeline library.
Pipeline: Multibranch 707.v71c3f0a_6ccdb_ checks that the file retrieved by readTrusted is inside of the checkout directory for the configured SCM.
Sensitive information disclosure in Pipeline: Groovy Plugin
SECURITY-2443 / CVE-2022-25180
Severity (CVSS): Medium
Affected plugin: workflow-cps
Description:
Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds.
This allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.
Pipeline: Groovy Plugin 2656.vf7a_e7b_75a_457 does not allow builds containing password parameters to be replayed.
Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin
SECURITY-2441 / CVE-2022-25181
Severity (CVSS): High
Affected plugin: workflow-cps-global-lib
Description:
Pipeline: Deprecated Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same workspace directory for all checkouts of Pipeline libraries with the same name regardless of the SCM being used and the source of the library configuration.
This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global Pipeline library already exists.
Pipeline: Deprecated Groovy Libraries Plugin 561.va_ce0de3c2d69 uses distinct checkout directories per SCM for Pipeline libraries.
Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin
SECURITY-2422 / CVE-2022-25182
Severity (CVSS): High
Affected plugin: workflow-cps-global-lib
Description:
Pipeline: Deprecated Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create directories without canonicalization or sanitization.
This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library is already configured.
Pipeline: Deprecated Groovy Libraries Plugin 561.va_ce0de3c2d69 sanitizes the names of Pipeline libraries when creating library directories.
Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin
SECURITY-2586 / CVE-2022-25183
Severity (CVSS): High
Affected plugin: workflow-cps-global-lib
Description:
Pipeline: Deprecated Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization.
This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library configured to use caching already exists.
Pipeline: Deprecated Groovy Libraries Plugin 561.va_ce0de3c2d69 sanitizes the names of Pipeline libraries when creating library cache directories.
Password parameter default values exposed by Pipeline: Build Step Plugin
SECURITY-2519 / CVE-2022-25184
Severity (CVSS): Medium
Affected plugin: pipeline-build-step
Description:
Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator.
This allows attackers with Item/Read permission to retrieve the default password parameter value from jobs.
Pipeline: Build Step Plugin 2.15.1 redacts password parameter in the generated pipeline script.
Stored XSS vulnerability in Generic Webhook Trigger Plugin
SECURITY-2592 / CVE-2022-25185
Severity (CVSS): High
Affected plugin: generic-webhook-trigger
Description:
Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause for the webhook.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to trigger builds using the webhook.
Generic Webhook Trigger Plugin 1.82 escapes the build cause when displayed on the UI.
This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the LTS upgrade guide.
Agent-to-controller security bypass in HashiCorp Vault Plugin
SECURITY-2429 / CVE-2022-25186
Severity (CVSS): Low
Affected plugin: hashicorp-vault-plugin
Description:
HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent.
This allows attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.
The functionality that allow agent processes to capture Vault secret can no longer be used in HashiCorp Vault Plugin 336.v182c0fbaaeb7.
Sensitive data stored in plain text by Support Core Plugin
SECURITY-2186 / CVE-2022-25187
Severity (CVSS): Medium
Affected plugin: support-core
Description:
Support Core Plugin has a feature to redact potentially sensitive information in the support bundle.
Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.
This sensitive information can be viewed by anyone with access to the bundle.
Support Core Plugin 2.79.1 adds a list of keywords whose associated values will be redacted.
This list is stored in the security-stop-words.txt file located in $JENKINS_HOME/support and can be amended to add additional keywords for values that should be redacted.
Path traversal vulnerability in Fortify Plugin
SECURITY-2214 / CVE-2022-25188
Severity (CVSS): Medium
Affected plugin: fortify
Description:
Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, which are used to write to files inside build directories.
This allows attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker.
Fortify Plugin 20.2.35 sanitizes the appName and appVersion parameters of its Pipeline steps when determining the resulting filename.
Stored XSS vulnerability in Custom Checkbox Parameter Plugin
SECURITY-2266 / CVE-2022-25189
Severity (CVSS): High
Affected plugin: custom-checkbox-parameter
Description:
Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Custom Checkbox Parameter Plugin 1.2 escapes parameter names of custom checkbox parameters.
Missing permission check in Conjur Secrets Plugin allows enumerating credentials IDs
SECURITY-2350 / CVE-2022-25190
Severity (CVSS): Medium
Affected plugin: conjur-credentials
Description:
Conjur Secrets Plugin 1.0.11 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
An enumeration of credentials IDs in Conjur Secrets Plugin 1.0.12 requires Overall/Administer permission.
Stored XSS vulnerability in Agent Server Parameter Plugin
SECURITY-2268 / CVE-2022-25191
Severity (CVSS): High
Affected plugin: agent-server-parameter
Description:
Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Agent Server Parameter Plugin 1.1 escapes parameter names of agent server parameters.
CSRF vulnerability and missing permission checks in Snow Commander Plugin allow capturing credentials
SECURITY-2536 / CVE-2022-25192 (CSRF), CVE-2022-25193 (missing permission check)
Severity (CVSS): Medium
Affected plugin: embotics-vcommander
Description:
Snow Commander Plugin 1.10 and earlier does not perform permission checks in methods implementing form validation.
This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Snow Commander Plugin 2.0 requires POST requests and Overall/Administer permission for the affected form validation methods.
CSRF vulnerability and missing permission check in autonomiq Plugin
SECURITY-2545 / CVE-2022-25194 (CSRF), CVE-2022-25195 (missing permission check)
Severity (CVSS): Medium
Affected plugin: autonomiq
Description:
autonomiq Plugin 1.15 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
autonomiq Plugin 1.16 requires POST requests and Overall/Administer permission for this HTTP endpoint.
Open redirect vulnerability in GitLab Authentication Plugin
SECURITY-1833 / CVE-2022-25196
Severity (CVSS): Medium
Affected plugin: gitlab-oauth
Description:
GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts and redirects users to that URL when the user has finished logging in.
This allows attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in.
Agent-to-controller security bypass in HashiCorp Vault Plugin allows reading arbitrary files
SECURITY-2521 / CVE-2022-25197
Severity (CVSS): Medium
Affected plugin: hashicorp-vault-plugin
Description:
HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.
This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.
This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.
CSRF vulnerability and missing permission check in SCP publisher Plugin
SECURITY-2323 / CVE-2022-25198 (CSRF), CVE-2022-25199 (missing permission check)
Severity (CVSS): Medium
Affected plugin: scp
Description:
SCP publisher Plugin 1.8 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified username and password.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
CSRF vulnerability and missing permission checks in Checkmarx Plugin allow capturing credentials
SECURITY-1017 / CVE-2022-25200 (CSRF), CVE-2022-25201 (missing permission check)
Severity (CVSS): Medium
Affected plugin: checkmarx
Description:
Checkmarx Plugin 2022.1.2 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Stored XSS vulnerability in Promoted Builds (Simple) Plugin
SECURITY-2334 / CVE-2022-25202
Severity (CVSS): Medium
Affected plugin: promoted-builds-simple
Description:
Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
Stored XSS vulnerability in Team Views Plugin
SECURITY-2324 / CVE-2022-25203
Severity (CVSS): High
Affected plugin: team-views
Description:
Team Views Plugin 0.9.0 and earlier does not escape team names.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
Agent-to-controller security bypass vulnerability in Doktor Plugin
SECURITY-2548 / CVE-2022-25204
Severity (CVSS): Low
Affected plugin: doktor
Description:
Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc.
Additionally, error messages allow attackers able to control agent processes to determine whether a file with a given name exists.
CSRF vulnerability and missing permission checks in dbCharts Plugin
SECURITY-2177 / CVE-2022-25205 (CSRF), CVE-2022-25206 (missing permission check)
Severity (CVSS): Medium
Affected plugin: dbCharts
Description:
dbCharts Plugin 0.5.2 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials.
Additionally, this method allows attackers to determine whether a class is available on the Jenkins controller’s class path through error messages.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
CSRF vulnerability and missing permission checks in Chef Sinatra Plugin allow XXE
SECURITY-1377 / CVE-2022-25207 (CSRF), CVE-2022-25208 (missing permission check), CVE-2022-25209 (XXE)
Severity (CVSS): High
Affected plugin: sinatra-chef-builder
Description:
Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse the response as XML.
As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Missing synchronization vulnerability in Convertigo Mobile Platform Plugin allow to capture passwords
SECURITY-2280 / CVE-2022-25210
Severity (CVSS): Low
Affected plugin: convertigo-mobile-platform
Description:
Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information.
This allows attackers with Item/Configure permission to capture passwords of the jobs that will be configured.
CSRF vulnerability and missing permission check in SWAMP Plugin allows capturing credentials
SECURITY-1988 / CVE-2022-25211 (missing permission check), CVE-2022-25212 (CSRF)
Severity (CVSS): Medium
Affected plugin: swamp
Description:
SWAMP Plugin 1.2.6 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Severity
- SECURITY-1017: Medium
- SECURITY-1377: High
- SECURITY-1833: Medium
- SECURITY-1988: Medium
- SECURITY-2177: Medium
- SECURITY-2186: Medium
- SECURITY-2214: Medium
- SECURITY-2266: High
- SECURITY-2268: High
- SECURITY-2280: Low
- SECURITY-2323: Medium
- SECURITY-2324: High
- SECURITY-2334: Medium
- SECURITY-2350: Medium
- SECURITY-2422: High
- SECURITY-2429: Low
- SECURITY-2441: High
- SECURITY-2443: Medium
- SECURITY-2463: High
- SECURITY-2519: Medium
- SECURITY-2521: Medium
- SECURITY-2536: Medium
- SECURITY-2545: Medium
- SECURITY-2548: Low
- SECURITY-2586: High
- SECURITY-2592: High
- SECURITY-2613: Medium
Affected Versions
- Agent Server Parameter Plugin up to and including 1.0
- autonomiq Plugin up to and including 1.15
- Checkmarx Plugin up to and including 2022.1.2
- Conjur Secrets Plugin up to and including 1.0.11
- Convertigo Mobile Platform Plugin up to and including 1.1
- Custom Checkbox Parameter Plugin up to and including 1.1
- dbCharts Plugin up to and including 0.5.2
- Doktor Plugin up to and including 0.4.1
- Fortify Plugin up to and including 20.2.34
- Generic Webhook Trigger Plugin up to and including 1.81
- GitLab Authentication Plugin up to and including 1.13
- HashiCorp Vault Plugin up to and including 3.8.0
- HashiCorp Vault Plugin up to and including 336.v182c0fbaaeb7
- Pipeline: Build Step Plugin up to and including 2.15
- Pipeline: Deprecated Groovy Libraries Plugin up to and including 552.vd9cc05b8a2e1
- Pipeline: Groovy Plugin up to and including 2648.va9433432b33c
- Pipeline: Multibranch Plugin up to and including 706.vd43c65dec013
- Promoted Builds (Simple) Plugin up to and including 1.9
- SCP publisher Plugin up to and including 1.8
- Chef Sinatra Plugin up to and including 1.20
- Snow Commander Plugin up to and including 1.10
- Support Core Plugin up to and including 2.79
- SWAMP Plugin up to and including 1.2.6
- Team Views Plugin up to and including 0.9.0
Fix
- Agent Server Parameter Plugin should be updated to version 1.1
- autonomiq Plugin should be updated to version 1.16
- Conjur Secrets Plugin should be updated to version 1.0.12
- Custom Checkbox Parameter Plugin should be updated to version 1.2
- Fortify Plugin should be updated to version 20.2.35
- Generic Webhook Trigger Plugin should be updated to version 1.82
- HashiCorp Vault Plugin should be updated to version 336.v182c0fbaaeb7
- Pipeline: Build Step Plugin should be updated to version 2.15.1
- Pipeline: Deprecated Groovy Libraries Plugin should be updated to version 561.va_ce0de3c2d69
- Pipeline: Groovy Plugin should be updated to version 2656.vf7a_e7b_75a_457
- Pipeline: Multibranch Plugin should be updated to version 707.v71c3f0a_6ccdb_
- Snow Commander Plugin should be updated to version 2.0
- Support Core Plugin should be updated to version 2.79.1
These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.
As of publication of this advisory, no fixes are available for the following plugins:
- Checkmarx Plugin
- Convertigo Mobile Platform Plugin
- dbCharts Plugin
- Doktor Plugin
- GitLab Authentication Plugin
- HashiCorp Vault Plugin
- Promoted Builds (Simple) Plugin
- SCP publisher Plugin
- Chef Sinatra Plugin
- SWAMP Plugin
- Team Views Plugin
Learn why we announce these issues.
Credit
The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:
- Daniel Beck, CloudBees, Inc. for SECURITY-1377, SECURITY-2422, SECURITY-2429, SECURITY-2463, SECURITY-2521, SECURITY-2536, SECURITY-2545, SECURITY-2548, SECURITY-2613
- Devin Nusbaum, CloudBees, Inc. for SECURITY-2586
- James Nord, CloudBees, Inc. for SECURITY-1833, SECURITY-2186, SECURITY-2443
- Justin Philip for SECURITY-2324, SECURITY-2334
- Kevin Guerroudj for SECURITY-2266, SECURITY-2268
- Kevin Guerroudj, Justin Philip, Marc Heyries for SECURITY-2323
- Matt Sicker, CloudBees, Inc. for SECURITY-2214
- Oleg Nenashev for SECURITY-1017
- Wadeck Follonier, CloudBees, Inc. for SECURITY-1988, SECURITY-2177, SECURITY-2280, SECURITY-2441
Related news
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Missing permission checks in Jenkins Snow Commander Plugin 1.10 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.
Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.
A cross-site request forgery (CSRF) vulnerability in Jenkins SCP publisher Plugin 1.8 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
Jenkins HashiCorp Vault Plugin 336.v182c0fbaaeb7 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.
Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in.
A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and error messages allow attackers able to control agent processes to determine whether a file with a given name exists.
Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
Missing permission checks in Jenkins Checkmarx Plugin 2022.1.2 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global Pipeline library already exists.
A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller JVM using specially crafted library names if a global Pipeline library is already configured.
Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker.
A missing permission check in Jenkins Conjur Secrets Plugin 1.0.11 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.