A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter.

CVE-2022-28117

Monstaftp v2.10.3 was discovered to allow attackers to execute Server-Side Request Forgery (SSRF).

Monstaftp 2.10.3 - Vulnerabilities - YouTube

CVE-2022-27469: Monstaftp 2.10.3 - Vulnerabilities

Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.

CVE-2022-29457: ADSelfService Plus Release Notes

We are excited to announce the addition of scenario-based bounty awards to the Dynamics 365 and Power Platform Bounty Program and M365 Bounty Program. Through these new scenario-based bounty awards, we encourage researchers to focus their research on vulnerabilities that have the highest potential impact on customer privacy and security. Awards increase by up to 30% ($26,000 USD total) for eligible scenario submissions.

We are excited to announce the addition of scenario-based bounty awards to the Dynamics 365 and Power Platform Bounty Program and M365 Bounty Program. Through these new scenario-based bounty awards, we encourage researchers to focus their research on vulnerabilities that have the highest potential impact on customer privacy and security. Awards increase by up to 30% ($26,000 USD total) for eligible scenario submissions.

**Dynamics 365 and Power Platform Bounty Program**

**Scenario**

**Maximum Award**

Cross-tenant information disclosure

$20,000

**M365 Bounty Program**

Eligible submissions may qualify for 15-30% bonuses on top of the general M365 bounty awards and will be awarded the single highest qualifying award.

**Scenario**

**Maximum Award**

Remote code execution through untrusted input (CWE-94 “Improper Control of Generation of Code (‘Code Injection’)”)

+30%

Remote code execution through untrusted input (CWE-502 “Deserialization of Untrusted Data”)

+30%

Unauthorized Cross-tenant and cross-identity sensitive data leakage (CWE-200 “Exposure of Sensitive Information to an Unauthorized Actor”)

+20%

Unauthorized cross-identity sensitive data leakage (CWE-488 “Exposure of Data Element to Wrong Session”)

+20%

“Confused deputy” vulnerabilities that can be used in a practical attack that accesses resources in a way that bypasses authentication (CWE-918 “Server-Side Request Forgery (SSRF)”)

+15%

These new bounty awards are part of our continued efforts to partner with the security research community as part of Microsoft’s holistic approach to defending against security threats. If you have any questions about these new scenarios or any other security research incentive program, please email us at bounty@microsoft.com.

_Lynn Miyashita and Madeline Eckert, MSRC_

Expanding High Impact Scenario Awards for Microsoft Bug Bounty Programs

Microsoft is excited to announce the addition of Exchange on-premises, SharePoint on-premises, and Skype for Business on-premises to the Applications and On-Premises Servers Bounty Program.
Through this expanded program, we encourage researchers to discover and report high-impact security vulnerabilities to help protect customers. We offer awards up to $26,000 USD for eligible submissions.

Microsoft is excited to announce the addition of Exchange on-premises, SharePoint on-premises, and Skype for Business on-premises to the Applications and On-Premises Servers Bounty Program.

Through this expanded program, we encourage researchers to discover and report high-impact security vulnerabilities to help protect customers. We offer awards up to $26,000 USD for eligible submissions. The following products are now eligible for bounty awards:

*   Exchange on-premises
*   SharePoint on-premises
*   Skype for Business on-premises

That’s not all! The bounty also includes high-impact scenarios offering the highest awards to research in areas with the highest potential impact to customer security.

**Security Impact**

**Severity Multiplier**

EXCHANGE ONLY: Server-Side Request Forgery allows an attacker to make server-side HTTP requests to arbitrary URLs.

20%

SHAREPOINT ONLY: Authenticated Server-Side Request Forgery allows an attacker to make authenticated server-side HTTP requests to arbitrary URL

20%

Insecure deserialization of user-controllable data, leading to remote code execution on server

30%

Arbitrary file write of user-controlled data on user-controlled location on the server.

20%

Authentication bypass allows for unauthenticated exploitation which results in mass exploitation of vulnerabilities

20%

Vulnerabilities within Exchange Emergency Mitigation Service (EEMS)

15%

To learn more about eligible scope and award amounts, please visit the Applications and On-Premises Servers Bounty Program page.

Microsoft’s bug bounty programs are just one of the many ways we invest in partnerships with the global security research community to help secure Microsoft customers. If you have any questions about the new On-Premises Servers scope or general inquiries about any other security research incentive program, please contact us at bounty@microsoft.com.

_Madeline Eckert and Lynn Miyashita, MSRC_

On-Premises Servers Products are Here! Introducing the Applications and On-Premises Servers Bug Bounty Program

Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Bitbucket Server Integration Plugin
*   Continuous Integration with Toad Edge Plugin
*   Coverage/Complexity Scatter Plot Plugin
*   Flaky Test Handler Plugin
*   instant-messaging Plugin
*   JiraTestResultReporter Plugin
*   Job and Node ownership Plugin
*   Pipeline: Phoenix AutoTest Plugin
*   Proxmox Plugin
*   Proxmox Plugin
*   Proxmox Plugin
*   RocketChat Notifier Plugin
*   SiteMonitor Plugin
*   Tests Selector Plugin

**Descriptions****Stored XSS vulnerability in Bitbucket Server Integration Plugin**

**SECURITY-2639 / CVE-2022-28133**  
**Severity (CVSS):** High  
**Affected plugin: atlassian-bitbucket-server-integration**  
**Description:**

Bitbucket Server Integration Plugin 2.0.0 through 3.1.0 (inclusive) does not limit URL schemes for callback URLs on OAuth consumers.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create BitBucket Server consumers.

Bitbucket Server Integration Plugin 3.2.0 limits allowed URL schemes to prevent creation of consumers with javascript: URL scheme.

**Missing permission checks in Bitbucket Server Integration Plugin**

**SECURITY-2640 / CVE-2022-28134**  
**Severity (CVSS):** Medium  
**Affected plugin: atlassian-bitbucket-server-integration**  
**Description:**

Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to create, view, and delete BitBucket Server consumers.

Bitbucket Server Integration Plugin 3.2.0 requires Overall/System Read permission to view BitBucket Server consumers, and Overall/Administer permission to modify them.

**Passwords stored in plain text by instant-messaging Plugin**

**SECURITY-2161 / CVE-2022-28135**  
**Severity (CVSS):** Low  
**Affected plugin: instant-messaging**  
**Description:**

instant-messaging Plugin provides a framework for plugins integrating Jenkins with instant messaging services.

instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on instant-messaging Plugin on the Jenkins controller.

These passwords can be viewed by users with access to the Jenkins controller file system.

instant-messaging Plugin 1.42 stores passwords for group chats encrypted once the integrating plugin’s configuration is saved again.

**CSRF vulnerability and missing permission check in JiraTestResultReporter Plugin**

**SECURITY-2236 / CVE-2022-28136 (CSRF), CVE-2022-28137 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: JiraTestResultReporter**  
**Description:**

JiraTestResultReporter Plugin 165.v817928553942 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

This form validation method requires POST requests and Overall/Administer permission in JiraTestResultReporter Plugin 166.v0cc6208295b5.

**CSRF vulnerability and missing permission check in RocketChat Notifier Plugin**

**SECURITY-2241 / CVE-2022-28138 (CSRF), CVE-2022-28139 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: rocketchatnotifier**  
**Description:**

RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

RocketChat Notifier Plugin 1.5.0 requires POST requests and Overall/Administer permission for the affected form validation method.

**XXE vulnerability in Flaky Test Handler Plugin**

**SECURITY-1896 / CVE-2022-28140**  
**Severity (CVSS):** High  
**Affected plugin: flaky-test-handler**  
**Description:**

Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Item/Configure permission to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Flaky Test Handler Plugin 1.2.2 disables external entity resolution for its XML parser.

**Password stored in plain text by Proxmox Plugin**

**SECURITY-2079 / CVE-2022-28141**  
**Severity (CVSS):** Low  
**Affected plugin: proxmox**  
**Description:**

Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller as part of its configuration.

This password can be viewed by users with access to the Jenkins controller file system.

Proxmox Plugin 0.6.0 stores the Proxmox Datacenter password encrypted once its configuration is saved again.

**SSL/TLS certificate validation globally disabled by Proxmox Plugin**

**SECURITY-2081 / CVE-2022-28142**  
**Severity (CVSS):** Medium  
**Affected plugin: proxmox**  
**Description:**

Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation for the entire Jenkins controller JVM when configured to ignore SSL/TLS issues.

Proxmox Plugin 0.7.0 no longer disables SSL/TLS certificate validation for the entire Jenkins controller JVM.

**CSRF vulnerability and missing permission checks in Proxmox Plugin**

**SECURITY-2082 / CVE-2022-28143 (CSRF), CVE-2022-28144 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: proxmox**  
**Description:**

Proxmox Plugin 0.7.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to:

*   connect to an attacker-specified host using attacker-specified username and password, performing a connection test,
    
*   disable SSL/TLS validation for the entire Jenkins controller JVM as part of the connection test (see SECURITY-2081 / CVE-2022-28142),
    
*   and test a rollback with attacker-specified parameters.
    

Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Proxmox Plugin 0.7.1 requires POST requests and Overall/Administer permission for the affected HTTP endpoints.

**XSS vulnerability in Continuous Integration with Toad Edge Plugin**

**SECURITY-1892 / CVE-2022-28145**  
**Severity (CVSS):** High  
**Affected plugin: ci-with-toad-edge**  
**Description:**

Continuous Integration with Toad Edge Plugin 2.3 and earlier uses a patched fork of an old version of the file browser for workspaces, archived artifacts, and userContent/ from Jenkins core (DirectoryBrowserSupport) to serve reports.

This fork removes the Content-Security-Policy header functionality introduced for SECURITY-95.

This results in a stored cross-site scripting (XSS) exploitable by attackers with Item/Configure permission or otherwise able to control report contents.

Continuous Integration with Toad Edge Plugin 2.4 uses the built-in Jenkins file browser to serve reports.

Some reports generated by this plugin rely on the ability to execute JavaScript. See the plugin’s documentation for a detailed explanation and options.

**Arbitrary file read vulnerability in Continuous Integration with Toad Edge Plugin**

**SECURITY-2633 / CVE-2022-28146**  
**Severity (CVSS):** Medium  
**Affected plugin: ci-with-toad-edge**  
**Description:**

Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps.

Continuous Integration with Toad Edge Plugin 2.4 only allows copying files from the node the build is executing on.

**Missing permission check in Continuous Integration with Toad Edge Plugin**

**SECURITY-2635 / CVE-2022-28147**  
**Severity (CVSS):** Medium  
**Affected plugin: ci-with-toad-edge**  
**Description:**

Continuous Integration with Toad Edge Plugin 2.3 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Continuous Integration with Toad Edge Plugin 2.4 requires Overall/Administer permission for the affected form validation method.

**Path traversal vulnerability on Windows in Continuous Integration with Toad Edge Plugin**

**SECURITY-2654 / CVE-2022-28148**  
**Severity (CVSS):** Medium  
**Affected plugin: ci-with-toad-edge**  
**Description:**

Continuous Integration with Toad Edge Plugin 2.3 and earlier uses a patched fork of an old version of the file browser for workspaces, archived artifacts, and userContent/ from Jenkins core (DirectoryBrowserSupport) to serve reports.

The fork did not receive the fix for SECURITY-2481 in Jenkins 2.315 and LTS 2.303.2.

This results in a path traversal vulnerability allowing attackers with Item/Read permission to obtain the contents of arbitrary files on Windows controllers.

Continuous Integration with Toad Edge Plugin 2.4 uses the built-in Jenkins file browser to serve reports, inheriting the fix in Jenkins core if running on a recent enough version.

**Stored XSS vulnerability in Job and Node ownership Plugin**

**SECURITY-2285 / CVE-2022-28149**  
**Severity (CVSS):** High  
**Affected plugin: ownership**  
**Description:**

Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of secondary owners.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**CSRF vulnerability and missing permission check in Job and Node ownership Plugin**

**SECURITY-2062 (1) / CVE-2022-28150 (CSRF), CVE-2022-28151 (missing permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: ownership**  
**Description:**

Job and Node ownership Plugin 0.13.0 and earlier does not perform a permission check in several HTTP endpoints.

This allows attackers with Item/Read permission to change the owners and item-specific permissions of a job.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

This CSRF vulnerability is only exploitable in Jenkins 2.286 and earlier, LTS 2.277.1 and earlier. See the LTS upgrade guide.

**CSRF vulnerability in Job and Node ownership Plugin**

**SECURITY-2062 (2) / CVE-2022-28152**  
**Severity (CVSS):** Medium  
**Affected plugin: ownership**  
**Description:**

Job and Node ownership Plugin 0.13.0 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to restore the default ownership of a job.

**Stored XSS vulnerability in SiteMonitor Plugin**

**SECURITY-1932 / CVE-2022-28153**  
**Severity (CVSS):** High  
**Affected plugin: sitemonitor**  
**Description:**

SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**XXE vulnerability in Coverage/Complexity Scatter Plot Plugin**

**SECURITY-1899 / CVE-2022-28154**  
**Severity (CVSS):** High  
**Affected plugin: covcomplplot**  
**Description:**

Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control the input files for the 'Public Coverage / Complexity Scatter Plot' post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

**XXE vulnerability in Pipeline: Phoenix AutoTest Plugin**

**SECURITY-1897 / CVE-2022-28155**  
**Severity (CVSS):** High  
**Affected plugin: phoenix-autotest**  
**Description:**

Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control the input files for the readXml or writeXml build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

**Path traversal vulnerability in Pipeline: Phoenix AutoTest Plugin allows reading arbitrary files**

**SECURITY-2683 / CVE-2022-28156**  
**Severity (CVSS):** Medium  
**Affected plugin: phoenix-autotest**  
**Description:**

Pipeline: Phoenix AutoTest Plugin 1.3 and earlier implements a Pipeline step (copy) to copy files from the running build’s directory on the Jenkins controller to an agent without sanitizing the path specified.

This allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace.

**Arbitrary file read vulnerability in Pipeline: Phoenix AutoTest Plugin**

**SECURITY-2684 / CVE-2022-28157**  
**Severity (CVSS):** Medium  
**Affected plugin: phoenix-autotest**  
**Description:**

Pipeline: Phoenix AutoTest Plugin 1.3 and earlier implements a Pipeline step (ftp) to upload files to an FTP server without limiting the source directory.

This allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server.

**Missing permission checks in Pipeline: Phoenix AutoTest Plugin allow enumerating credentials IDs**

**SECURITY-2685 / CVE-2022-28158**  
**Severity (CVSS):** Medium  
**Affected plugin: phoenix-autotest**  
**Description:**

Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**Stored XSS vulnerability in Tests Selector Plugin**

**SECURITY-2262 / CVE-2022-28159**  
**Severity (CVSS):** High  
**Affected plugin: selected-tests-executor**  
**Description:**

Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**Arbitrary file read vulnerability in Tests Selector Plugin**

**SECURITY-2338 / CVE-2022-28160**  
**Severity (CVSS):** Medium  
**Affected plugin: selected-tests-executor**  
**Description:**

Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller using the Choosing Tests parameter.

**Severity**

*   SECURITY-1892: High
*   SECURITY-1896: High
*   SECURITY-1897: High
*   SECURITY-1899: High
*   SECURITY-1932: High
*   SECURITY-2062 (1): Medium
*   SECURITY-2062 (2): Medium
*   SECURITY-2079: Low
*   SECURITY-2081: Medium
*   SECURITY-2082: Medium
*   SECURITY-2161: Low
*   SECURITY-2236: Medium
*   SECURITY-2241: Medium
*   SECURITY-2262: High
*   SECURITY-2285: High
*   SECURITY-2338: Medium
*   SECURITY-2633: Medium
*   SECURITY-2635: Medium
*   SECURITY-2639: High
*   SECURITY-2640: Medium
*   SECURITY-2654: Medium
*   SECURITY-2683: Medium
*   SECURITY-2684: Medium
*   SECURITY-2685: Medium

**Affected Versions**

*   **Bitbucket Server Integration Plugin** up to and including 3.1.0
*   **Continuous Integration with Toad Edge Plugin** up to and including 2.3
*   **Coverage/Complexity Scatter Plot Plugin** up to and including 1.1.1
*   **Flaky Test Handler Plugin** up to and including 1.2.1
*   **instant-messaging Plugin** up to and including 1.41
*   **JiraTestResultReporter Plugin** up to and including 165.v817928553942
*   **Job and Node ownership Plugin** up to and including 0.13.0
*   **Pipeline: Phoenix AutoTest Plugin** up to and including 1.3
*   **Proxmox Plugin** up to and including 0.5.0
*   **Proxmox Plugin** up to and including 0.6.0
*   **Proxmox Plugin** up to and including 0.7.0
*   **RocketChat Notifier Plugin** up to and including 1.4.10
*   **SiteMonitor Plugin** up to and including 0.6
*   **Tests Selector Plugin** up to and including 1.3.3

**Fix**

*   **Bitbucket Server Integration Plugin** should be updated to version 3.2.0
*   **Continuous Integration with Toad Edge Plugin** should be updated to version 2.4
*   **Flaky Test Handler Plugin** should be updated to version 1.2.2
*   **instant-messaging Plugin** should be updated to version 1.42
*   **JiraTestResultReporter Plugin** should be updated to version 166.v0cc6208295b5
*   **Proxmox Plugin** should be updated to version 0.6.0
*   **Proxmox Plugin** should be updated to version 0.7.0
*   **Proxmox Plugin** should be updated to version 0.7.1
*   **RocketChat Notifier Plugin** should be updated to version 1.5.0

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Coverage/Complexity Scatter Plot Plugin
*   Job and Node ownership Plugin
*   Pipeline: Phoenix AutoTest Plugin
*   SiteMonitor Plugin
*   Tests Selector Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-1892, SECURITY-2062 (1), SECURITY-2062 (2), SECURITY-2081, SECURITY-2082, SECURITY-2683, SECURITY-2684, SECURITY-2685
*   **Daniel Beck, CloudBees, Inc. and, independently, Long Nguyen, Viettel Cyber Security, and Marc Heyries** for SECURITY-2079
*   **Jeff Thompson, CloudBees, Inc.** for SECURITY-1896, SECURITY-1897, SECURITY-1899
*   **Justin Philip** for SECURITY-2338
*   **Kevin Guerroudj** for SECURITY-2236, SECURITY-2262, SECURITY-2285
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2633, SECURITY-2635, SECURITY-2639, SECURITY-2640
*   **Marc Heyries** for SECURITY-2241
*   **Son Nguyen (@s0nnguy3n\_)** for SECURITY-2161
*   **Wadeck Follonier, CloudBees, Inc.** for SECURITY-1932

CVE-2022-28140: Jenkins Security Advisory 2022-03-29

A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

CVE-2022-28137: Jenkins Security Advisory 2022-03-29

A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

CVE-2022-28147: Jenkins Security Advisory 2022-03-29

Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

CVE-2022-28141: Jenkins Security Advisory 2022-03-29

Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issues.

Tag

#ssrf