Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Azure Credentials Plugin
*   Email Extension Plugin
*   JUnit Plugin
*   Pipeline: Build Step Plugin
*   Synopsys Coverity Plugin

**Descriptions****Stored XSS vulnerability in JUnit Plugin**

**SECURITY-3032 / CVE-2023-25761**  
**Severity (CVSS):** High  
**Affected plugin: junit**  
**Description:**

JUnit Plugin 1166.va\_436e268e972 and earlier does not escape test case class names in JavaScript expressions.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

JUnit Plugin 1166.1168.vd6b\_8042a\_06de escapes affected test case class names in JavaScript expressions.

**Stored XSS vulnerability in Pipeline: Build Step Plugin**

**SECURITY-3019 / CVE-2023-25762**  
**Severity (CVSS):** High  
**Affected plugin: pipeline-build-step**  
**Description:**

Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.

Pipeline: Build Step Plugin 2.18.1 escapes job names in the affected JavaScript expression.

**XSS vulnerability in bundled email templates in Email Extension Plugin**

**SECURITY-2931 / CVE-2023-25763**  
**Severity (CVSS):** High  
**Affected plugin: email-ext**  
**Description:**

Email Extension Plugin bundled multiple preconfigured templates for notification emails. The Email Template Testing feature can be used to see what these and other templates would look like based on a given build.

Email Extension Plugin 2.93 and earlier does not escape various fields included in those email templates, like build display name, user display name, and the names of tests.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control affected fields.

Email Extension Plugin 2.93.1 escapes affected fields in bundled email templates.

**Stored XSS vulnerability in custom email templates in Email Extension Plugin**

**SECURITY-2934 / CVE-2023-25764**  
**Severity (CVSS):** High  
**Affected plugin: email-ext**  
**Description:**

Email Extension Plugin allows defining custom email templates using Config File Provider plugin as Jelly or Groovy files. The Email Template Testing feature can be used to see what these templates would look like based on a given build by specifying the managed: name prefix.

Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.

Email Extension Plugin 2.93.1 renders email template previews inside a sandboxed iframe.

**Script Security sandbox bypass vulnerability in Email Extension Plugin**

**SECURITY-2939 / CVE-2023-25765**  
**Severity (CVSS):** High  
**Affected plugin: email-ext**  
**Description:**

Email Extension Plugin allows defining custom email templates using Config File Provider plugin as Jelly or Groovy files. When defined inside a folder, email templates need to be subject to Script Security protection (sandboxed execution or full-script approval).

In Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection.

This vulnerability allows attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Email templates defined in folders are subject to sandbox protection in Email Extension Plugin 2.93.1.

**Missing permission checks in Azure Credentials Plugin allow enumerating credentials IDs**

**SECURITY-1757 / CVE-2023-25766**  
**Severity (CVSS):** Medium  
**Affected plugin: azure-credentials**  
**Description:**

Azure Credentials Plugin 253.v887e0f9e898b and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Azure Credentials Plugin 254.v64da\_8176c83a requires Overall/Administer permission.

**CSRF vulnerability and missing permission checks in Azure Credentials Plugin**

**SECURITY-1756 / CVE-2023-25767 (CSRF), CVE-2023-25768 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: azure-credentials**  
**Description:**

Azure Credentials Plugin 253.v887e0f9e898b and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified web server.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

These form validation methods require POST requests and Overall/Administer permission in Azure Credentials Plugin 254.v64da\_8176c83a.

**Missing permission checks in Synopsys Coverity Plugin allow enumerating credentials IDs**

**SECURITY-2793 (1) / CVE-2023-23850**  
**Severity (CVSS):** Medium  
**Affected plugin: synopsys-coverity**  
**Description:**

Synopsys Coverity Plugin 3.0.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Synopsys Coverity Plugin 3.0.3 requires the appropriate permissions.

**CSRF vulnerability and missing permission checks in Synopsys Coverity Plugin allow capturing credentials**

**SECURITY-2793 (2) / CVE-2023-23847 (CSRF), CVE-2023-23848 (missing permission check)**  
**Severity (CVSS):** High  
**Affected plugin: synopsys-coverity**  
**Description:**

Synopsys Coverity Plugin 3.0.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Synopsys Coverity Plugin 3.0.3 requires POST requests and the appropriate permissions for the affected HTTP endpoints.

**Severity**

*   SECURITY-1756: Medium
*   SECURITY-1757: Medium
*   SECURITY-2793 (1): Medium
*   SECURITY-2793 (2): High
*   SECURITY-2931: High
*   SECURITY-2934: High
*   SECURITY-2939: High
*   SECURITY-3019: High
*   SECURITY-3032: High

**Affected Versions**

*   **Azure Credentials Plugin** up to and including 253.v887e0f9e898b
*   **Email Extension Plugin** up to and including 2.93
*   **JUnit Plugin** up to and including 1166.va\_436e268e972
*   **Pipeline: Build Step Plugin** up to and including 2.18
*   **Synopsys Coverity Plugin** up to and including 3.0.2

**Fix**

*   **Azure Credentials Plugin** should be updated to version 254.v64da\_8176c83a
*   **Email Extension Plugin** should be updated to version 2.93.1
*   **JUnit Plugin** should be updated to version 1166.1168.vd6b\_8042a\_06de
*   **Pipeline: Build Step Plugin** should be updated to version 2.18.1
*   **Synopsys Coverity Plugin** should be updated to version 3.0.3

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2793 (1), SECURITY-2793 (2)
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-3019, SECURITY-3032
*   **Wadeck Follonier, CloudBees, Inc.** for SECURITY-1756, SECURITY-1757
*   **Yaroslav Afenkin, CloudBees, Inc.** for SECURITY-2931, SECURITY-2939
*   **Yaroslav Afenkin, CloudBees, Inc. and independently, Valdes Che Zogou** for SECURITY-2934

CVE-2023-25762: Jenkins Security Advisory 2023-02-15

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.

CVE-2023-25761: Jenkins Security Advisory 2023-02-15

LexisNexis Firco Compliance Link 3.7 allows CSRF.

Firco Compliance Link - Version 3.7 - Insufficient CSRF Protection

\===============================================================================

Identifiers

\-------------------------------------------------

CVE-2022-29557

Vendor

\-------------------------------------------------

Lexis Nexis (https://risk.lexisnexis.com/)

Product

\-------------------------------------------------

Firco Compliance Link

Affected versions

\-------------------------------------------------

Firco Compliance Link - Version 3.7

Credit

\-------------------------------------------------

Thomas Caesar (@Q2Flc2Fy) / Lufthansa Industry Solutions (@LHIND\_DLH)

Vulnerability summary

\-------------------------------------------------

Firco Compliance Link - Version 3.7 has insufficient CSRF Protection. Only in POST requests are sufficient CSRF protection mechanisms enforced. Some GET requests are also worth protecting.

Technical details

\------------------------------------------------

An attacker can forge a request to delete users and then trick any user with a valid session to perform this request.

Proof of concept

\-------------------------------------------------

Withheld

Solution

\-------------------------------------------------

Enable CSRF protection also for GET requests.

Timeline

\-------------------------------------------------

Date | Status

\------------|--------------------

11–MAI-2022 | Reported to vendor

11-AUG-2022 | End of 90 days Full Disclosure Time

14-FEB-2023 | FULL disclosure

CVE-2022-29557: CVE-List/CVE-2022-29557.txt at main · Q2Flc2FySec/CVE-List

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the ‘kvstore_client’ REST endpoint lets a potential attacker update SSG [App Key Value Store (KV store)](https://docs.splunk.com/Documentation/Splunk/latest/Admin/AboutKVstore) collections using an HTTP GET request. SSG is a Splunk-built app that comes with Splunk Enterprise. The vulnerability affects instances with SSG and Splunk Web enabled.

Try in Splunk Security Cloud

**Description**

In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a cross-site request forgery in the Splunk Secure Gateway (SSG) app in the kvstore\_client endpoint allows for updating SSG KV store collections via a GET request. SSG is a Splunk Built app included by default with Splunk Enterprise. The vulnerability affects instances with SSG and Splunk Web enabled. This hunting search provides information on affected server specific method and post data that may reveal exploitation of this vulnerability.

*   **Type**: TTP
*   **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
    
*   **Last Updated**: 2023-02-14
*   **Author**: Rod Soto
*   **ID**: 4742d5f7-ce00-45ce-9c79-5e98b43b4410

**Annotations**ATT&CK

**ATT&CK**

ID

Technique

Tactic

T1189

Drive-by Compromise

Initial Access

Kill Chain Phase

*   Exploitation

NIST

*   DE.CM

CIS20

*   CIS 3
*   CIS 5
*   CIS 16

CVE**Search**

    
    1
    2
    3
    
    `splunkda` uri_path="/en-US/splunkd/__raw/services/ssg/kvstore_client" method="GET" delete_field_value="spacebridge_server" status="200"  
    | table  splunk_server status uri delete_field_value method post_data  
    | `splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter`
    
    

**Macros**

The SPL above uses the following Macros:

*   splunkda

>  **splunk\_csrf\_in\_the\_ssg\_kvstore\_client\_endpoint\_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

**Required fields**

List of fields required to use this analytic.

*   splunk\_server
*   status
*   uri
*   delete\_field\_value
*   method
*   post\_data

**How To Implement**

Requires access to internal index.

**Known False Positives**

This hunting search only applies to the affected versions and setup mentioned in the description of this search, it does not extract payload so it requires manual investigation after executing search. This search will produce false positives.

**Associated Analytic Story**

*   Splunk Vulnerabilities

**RBA**

Risk Score

Impact

Confidence

Message

25.0

50

50

Potential CSRF exploitation attempt from $host$

>  The Risk Score is calculated by the following formula: Risk Score = (Impact \* Confidence/100). Initial Confidence and Impact is set by the analytic author.

**Reference**

*   https://www.splunk.com/en\_us/product-security.html

**Test Dataset**

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

*   https://media.githubusercontent.com/media/splunk/attack\_data/master/datasets/attack\_techniques/T1189/splunk/splunk\_csrf\_in\_the\_ssg\_kvstore\_client\_endpoint\_data.log

_source_ | _version_: **1**

CVE-2023-22942: Splunk csrf in the ssg kvstore client endpoint

Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions.

**Solution**

Update the WordPress WP Tabs plugin to the latest available version (at least 2.1.15).

Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress WP Tabs Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 2.1.15.

**1 other known vulnerability for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-25065: WordPress WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 - Cross Site Request Forgery (CSRF) - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions.

**Solution**

Update the WordPress Material Design Icons for Page Builders plugin to the latest available version (at least 1.4.3).

Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Material Design Icons for Page Builders Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 1.4.3.

**1 other known vulnerability for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-24382: WordPress Material Design Icons for Page Builders plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 versions.

**Solution**

Update the WordPress Quiz And Survey Master plugin to the latest available version (at least 8.0.8).

Oliver K. discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Quiz And Survey Master Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 8.0.8.

**19 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-46862: WordPress Quiz And Survey Master plugin <= 8.0.7 - Cross Site Request Forgery (CSRF) - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 versions.

**Solution**

Update the WordPress Ecwid Shopping Cart plugin to the latest available version (at least 6.11.4).

Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Ecwid Shopping Cart Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 6.11.4.

**2 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-24377: WordPress Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 - Cross Site Request Forgery (CSRF) - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data plugin <= 1.7.0.6 versions.

**Solution**

No patched version is available. No reply from the vendor.

ptsfence discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Corona Virus (COVID-19) Banner & Live Data Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-43469: WordPress Corona Virus (COVID-19) Banner & Live Data plugin <= 1.7.0.6 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.30.7212 versions.

**Solution**

Update the WordPress FV Flowplayer Video Player plugin to the latest available version (at least 7.5.31.7212).

Cat discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress FV Flowplayer Video Player Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 7.5.31.7212.

**10 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

Tag

#csrf