Summary
Ein Angreifer kann mehrere Schwachstellen in Jenkins ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, XSS-Angriffe durchzuführen, Dateien zu manipulieren oder Cross-Site Request Forgery-Angriffe durchzuführen.
Product
Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.
Vulnerabilities 9
-
High 8.8
Jenkins temporary plugin file created with insecure permissions
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system te…
-
High 8.0
Jenkins Cross-site Scripting vulnerability
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parame…
-
High 8.0
Jenkins Build Failure Analyzer Plugin Cross-site Scripting vulnerability
Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or update Failure Causes.
-
Medium 4.3CVE-2023-43494 Public exploit
Jenkins does not exclude sensitive build variables from search
Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from the search in the build history widget, allowing attackers with Item/Read permission to …
-
Medium 4.3
Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password.
-
Medium 4.3
Jenkins Build Failure Analyzer Plugin missing permission check
A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.
-
Medium 4.3
Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability
A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Failure Causes.
-
Low 3.6
Jenkins temporary uploaded file created with insecure permissions
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attacke…
-
Low 3.6
Jenkins temporary uploaded file created with insecure permissions
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers…
Revision history
-
#1
Initiale Fassung
References
-
Jenkins Security Advisory 2023-09-20 vom 2023-09-20
https://www.jenkins.io/security/advisory/2023-09-20/