High WID-SEC-2022-2262 7 CVEs

Jenkins: Mehrere Schwachstellen

Published Dec 7, 2022 · Updated Dec 7, 2022 · de-DE

Vendor: Jenkins Project Product: Jenkins Plugins

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsvorkehrungen zu umgehen und einen Cross-Site-Scripting-Angriff durchzuführen.

Product

Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Vulnerabilities 7

Critical 9.8

CVE-2022-46682

Jenkins Plot Plugin XML External Entity Reference vulnerability

Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Project Jenkins Plot Plugin org.jenkins-ci.plugins:plot Web / CMS Maven

Dec 7, 2022
Medium 6.5

CVE-2022-46688

Jenkins Sonar Gerrit Plugin vulnerable to Cross-Site Request Forgery

A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials ID…

Jenkins Project Jenkins Sonar Gerrit Plugin org.jenkins-ci.plugins:sonar-gerrit Web / CMS Maven

Dec 7, 2022
Medium 6.1

CVE-2022-46683

Jenkins Google Login Plugin Open Redirect vulnerability

Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins.

Jenkins Project Jenkins Google Login Plugin org.jenkins-ci.plugins:google-login Web / CMS Maven

Dec 7, 2022
Medium 5.4

CVE-2022-46684

Stored XSS vulnerability in Jenkins Checkmarx Plugin

Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting in a stored cross-site scripting (XSS) vulnerability.

Jenkins Project Jenkins Checkmarx Plugin com.checkmarx.jenkins:checkmarx Web / CMS Maven

Dec 7, 2022
Medium 5.4

CVE-2022-46686

Jenkins Custom Build Properties Plugin vulnerable to Cross-site Scripting

Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Build Properties and Build Summary pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by…

Jenkins Project Jenkins Custom Build Properties Plugin io.jenkins.plugins:custom-build-properties Web / CMS Maven

Dec 7, 2022
Medium 5.4

CVE-2022-46687

Cross-site Scripting in Jenkins Spring Config Plugin

Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to change build display names.

Jenkins Project Jenkins Spring Config Plugin io.jenkins.plugins:spring-config Web / CMS Maven

Dec 7, 2022
Medium 4.3

CVE-2022-46685

Jenkins Gitea Plugin vulnerable to Cleartext Transmission of Sensitive Information

In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log.

Jenkins Project Jenkins Gitea Plugin org.jenkins-ci.plugins:gitea Web / CMS Maven

Dec 7, 2022

Revision history

2022-12-07 #1
Initiale Fassung

References

Jenkins Security Advisory 2022-12-07 vom 2022-12-07
https://www.jenkins.io/security/advisory/2022-12-07/