High WID-SEC-2023-1902 8 CVEs

Jenkins: Mehrere Schwachstellen

Published Jul 26, 2023 · Updated Jul 26, 2023 · de-DE

Vendor: Jenkins Project Product: Jenkins Product: Jenkins LTS < 2.401.3 Product: Jenkins Plugins Product: Jenkins Weekly < 2.416 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen und einen Cross-Site-Scripting-Angriff durchzuführen.

Product

Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.

Vulnerabilities 8

High 8.0

CVE-2023-39151

Jenkins Stored Cross-site Scripting vulnerability

Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build lo…

Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven

Jul 26, 2023
High 7.7

CVE-2023-3442

Missing Authorization in Jenkins plug-in for ServiceNow DevOps

A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version …

ServiceNow Jenkins plug-in for ServiceNow DevOps io.jenkins.plugins:servicenow-devops Web / CMS Maven

Jul 26, 2023
Medium 6.5

CVE-2023-39152

Incorrect control flow in Jenkins Gradle Plugin breaks credentials masking in the build log

Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.

Jenkins Project Jenkins Gradle Plugin org.jenkins-ci.plugins:gradle Web / CMS Maven

Jul 26, 2023
Medium 6.1

CVE-2023-3414

Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps

A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 ver…

ServiceNow Jenkins plug-in for ServiceNow DevOps io.jenkins.plugins:servicenow-devops Web / CMS Maven

Jul 26, 2023
Medium 5.4

CVE-2023-39153

CSRF vulnerability in GitLab Authentication Plugin

A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.

Jenkins Project Jenkins Gitlab Authentication Plugin org.jenkins-ci.plugins:gitlab-oauth Web / CMS Maven

Jul 26, 2023
Medium 4.3

CVE-2023-39156

CSRF vulnerability in Bazaar Plugin

A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.

Jenkins Project Jenkins Bazaar Plugin org.jenkins-ci.plugins:bazaar Web / CMS Maven

Jul 26, 2023
Medium 4.2

CVE-2023-39154

Incorrect permission checks in Qualys Web App Scanning Connector Plugin allow capturing credentials

Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another …

Jenkins Project Jenkins Qualys Web App Scanning Connector Plugin com.qualys.plugins:qualys-was Web / CMS Maven

Jul 26, 2023
Low 3.1

CVE-2023-39155

Secret displayed without masking by Chef Identity Plugin

Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.

Jenkins Project Jenkins Chef Identity Plugin org.jenkins-ci.plugins:chef-identity Web / CMS Maven

Jul 26, 2023

Revision history

2023-07-26 #1
Initiale Fassung

References

Jenkins Security Advisory 2023-07-26 vom 2023-07-26
https://www.jenkins.io/security/advisory/2023-07-26/