Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Jenkins (core)
*   Bazaar Plugin
*   Chef Identity Plugin
*   GitLab Authentication Plugin
*   Gradle Plugin
*   Qualys Web App Scanning Connector Plugin
*   ServiceNow DevOps Plugin

**Descriptions****Stored XSS vulnerability**

**SECURITY-3188 / CVE-2023-39151**  
**Severity (CVSS):** High  
**Description:**

Jenkins applies formatting to the console output of builds, transforming plain URLs into hyperlinks.

Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs of these hyperlinks in build logs.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.

Jenkins 2.416, LTS 2.401.3 encodes URLs of affected hyperlink annotations in build logs.

**Incorrect control flow in Gradle Plugin breaks credentials masking in the build log**

**SECURITY-3208 / CVE-2023-39152**  
**Severity (CVSS):** Medium  
**Affected plugin: gradle**  
**Description:**

Gradle Plugin 2.8 improperly invokes APIs available only on the controller from an agent when setting up build log annotations, causing an exception.

As a result, credentials may not be masked (i.e., replaced with asterisks) in the build log in some circumstances.

Gradle Plugin 2.8.1 improves the control flow and handles the exception, so that credentials masking is not affected.

An improvement in Pipeline: API 1232.v1679fa\_2f0f76 prevents issues like this from affecting credentials masking in the future. As of the publication of this advisory, the Jenkins security team is not aware of other plugins with a similar issue.

**CSRF vulnerability in GitLab Authentication Plugin**

**SECURITY-2696 / CVE-2023-39153**  
**Severity (CVSS):** Medium  
**Affected plugin: gitlab-oauth**  
**Description:**

GitLab Authentication Plugin 1.17.1 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request.

This vulnerability allows attackers to trick users into logging in to the attacker’s account.

GitLab Authentication Plugin 1.18 implements a state parameter in its OAuth flow.

**CSRF vulnerability and missing permission check in ServiceNow DevOps Plugin allow capturing credentials**

**SECURITY-3129 / CVE-2023-3414 (CSRF), CVE-2023-3442 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: servicenow-devops**  
**Description:**

ServiceNow DevOps Plugin 1.38.0 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

ServiceNow DevOps Plugin 1.38.1 requires POST requests and Overall/Administer permission for the affected form validation method.

**Incorrect permission checks in Qualys Web App Scanning Connector Plugin allow capturing credentials**

**SECURITY-3012 / CVE-2023-39154**  
**Severity (CVSS):** Medium  
**Affected plugin: qualys-was**  
**Description:**

Qualys Web App Scanning Connector Plugin 2.0.10 and earlier does not correctly perform permission checks in several HTTP endpoints.

This allows attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Qualys Web App Scanning Connector Plugin 2.0.11 requires the appropriate permissions for the affected HTTP endpoints.

**Secret displayed without masking by Chef Identity Plugin**

**SECURITY-3192 / CVE-2023-39155**  
**Severity (CVSS):** Low  
**Affected plugin: chef-identity**  
**Description:**

Chef Identity Plugin stores the user.pem key in its global configuration file io.chef.jenkins.ChefIdentityBuildWrapper.xml on the Jenkins controller as part of its configuration.

While this key is stored encrypted on disk, in Chef Identity Plugin 2.0.3 and earlier the global configuration form does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.

**CSRF vulnerability in Bazaar Plugin**

**SECURITY-3095 / CVE-2023-39156**  
**Severity (CVSS):** Medium  
**Affected plugin: bazaar**  
**Description:**

Bazaar Plugin 1.22 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to delete previously created Bazaar SCM tags.

**Severity**

*   SECURITY-2696: Medium
*   SECURITY-3012: Medium
*   SECURITY-3095: Medium
*   SECURITY-3129: Medium
*   SECURITY-3188: High
*   SECURITY-3192: Low
*   SECURITY-3208: Medium

**Affected Versions**

*   **Jenkins weekly** up to and including 2.415
*   **Jenkins LTS** up to and including 2.401.2
*   **Bazaar Plugin** up to and including 1.22
*   **Chef Identity Plugin** up to and including 2.0.3
*   **GitLab Authentication Plugin** up to and including 1.17.1
*   **Gradle Plugin** up to and including 2.8
*   **Qualys Web App Scanning Connector Plugin** up to and including 2.0.10
*   **ServiceNow DevOps Plugin** up to and including 1.38.0

**Fix**

*   **Jenkins weekly** should be updated to version 2.416
*   **Jenkins LTS** should be updated to version 2.401.3
*   **GitLab Authentication Plugin** should be updated to version 1.18
*   **Gradle Plugin** should be updated to version 2.8.1
*   **Qualys Web App Scanning Connector Plugin** should be updated to version 2.0.11
*   **ServiceNow DevOps Plugin** should be updated to version 1.38.1

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Bazaar Plugin
*   Chef Identity Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Alvaro Muñoz (@pwntester), GitHub Security Lab** for SECURITY-3129
*   **Andrea Chiera, CloudBees, Inc.** for SECURITY-3192
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-3095
*   **Kevin Guerroudj, CloudBees, Inc. and Devin Nusbaum, CloudBees, Inc.** for SECURITY-3188
*   **Wadeck Follonier, CloudBees Inc.** for SECURITY-2696
*   **Yaroslav Afenkin, CloudBees, Inc.** for SECURITY-3012

CVE-2023-39151: Jenkins Security Advisory 2023-07-26

Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

CVE-2023-39154: Jenkins Security Advisory 2023-07-26

Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.

CVE-2023-39152: Jenkins Security Advisory 2023-07-26

A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.

CVE-2023-39156: Jenkins Security Advisory 2023-07-26

ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.

CVE-2023-26911

SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileges via the ajaxOrderTracking.php component.

In the module “Sendinblue - All-in-one marketing tool” (sendinblue) up to versions 4.0.14 from Sendinblue for PrestaShop, an anonymous user can perform SQL injection in affected versions if double optin is enabled. 4.0.15 fixed vulnerabilities.

**Summary**

*   **CVE ID**: CVE-2023-26859
*   **Published at**: 2023-07-25
*   **Advisory source**: Friends-of-Presta.org
*   **Platform**: PrestaShop
*   **Product**: sendinblue
*   **Impacted release**: <= 4.0.14 (4.0.15 fixed the vulnerability)
*   **Product author**: Sendinblue
*   **Weakness**: CWE-89
*   **Severity**: high (8.1)

**Description**

In sendinblue module for PrestaShop up to 4.0.14, a sensitive SQL call on ajaxOrderTracking.php can be executed with a trivial http call and exploited to forge a blind SQL injection throught for instance the POST or GET submitted id_shop_group variable if the double optin option is set.

**CVSS base metrics**

*   **Attack vector**: network
*   **Attack complexity**: high
*   **Privilege required**: none
*   **User interaction**: none
*   **Scope**: unchanged
*   **Confidentiality**: high
*   **Integrity**: high
*   **Availability**: high

**Vector string**: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

**Possible malicious usage**

*   Obtain admin access
*   Remove data from the associated PrestaShop
*   Copy/paste data from sensitive tables to FRONT to expose tokens and unlock admins’s ajax scripts
*   Rewrite SMTP settings to hijack emails

**Patch**

For PrestaShop 1.6, with sendingblue version 2.8.8, apply this patch:

    --- a/modules/sendinblue/ajaxOrderTracking.php
    +++ b/modules/sendinblue/ajaxOrderTracking.php
    @@ -59,7 +59,7 @@ if ($sendin_order_track_status == 0) {
             $dateFormate = 'm-d-Y';
         }
         $condition = '';
    -    $id_shop_group = !empty($id_shop_group) ? $id_shop_group : 'NULL';
    +    $id_shop_group = !empty($id_shop_group) ? (int) $id_shop_group : 'NULL';
         $id_shop = !empty($id_shop) ? $id_shop : 'NULL';
         
         if ($id_shop === 'NULL' && $id_shop_group === 'NULL') {
    
    

For PrestaShop 1.7, with sendingblue version 4.x, _remove all files ajaxXXX.php_ especially _ajaxOrderTracking.php_.

**Other recommandations**

*   It’s **highly recommended to upgrade the module** to the latest version or to **delete** the module if unused.
*   Upgrade PrestaShop to the latest version to disable multiquery execution (separated by “;”) - be warned that this functionality **WILL NOT** protect your SHOP against injection SQL which uses the UNION clause to steal data.
*   Change the default database prefix ps_ by a new longer arbitrary prefix. Nevertheless, be warned that this is useless against blackhats with DBA senior skills because of a design vulnerability in DBMS
*   Activate OWASP 942’s rules on your WAF (Web application firewall), be warned that you will probably break your backoffice and you will need to pre-configure some bypasses against these set of rules.

**Timeline**

Date

Action

2022-12-02

Issue discovered during a code reviews by 202 ecommerce

2022-12-02

Contact the author

2023-12-19

First fixed candidate from the author 4.0.15 for PrestaShop 1.7. PrestShop 1.6 remain vulnerable

2022-12-19

Contact the author to fix others vulnerabilities

2023-01-31

Contact PrestaShop team to claim a fix on all available package downloadable

2023-02-12

Request a CVE ID

2023-07-23

Publication of the CVE

**Links**

*   PrestaShop addons product page
*   National Vulnerability Database

CVE-2023-26859: [CVE-2023-26859] Multiple improper neutralizations of an SQL parameters in Sendinblue module for PrestaShop

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with SYSTEM privileges.

**We’re Geekbuilt.****®** 

Developed by network and systems engineers who know what it takes to manage today’s dynamic IT environments, SolarWinds has a deep connection to the IT community.

The result? IT management products that are effective, accessible, and easy to use.

CVE-2023-23844: SolarWinds Trust Center Security Advisories | CVE-2023-23844

The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges.

CVE-2023-33224: SolarWinds Platform Incorrect Behavior Order Vulnerability

The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands.

CVE-2023-23843: SolarWinds Platform Incorrect Comparison Vulnerability | CVE-2023-23843

Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validation could be bypassed.

Source

CVE