Jenkins Plugins: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• High 8.8
  CVE-2025-24398

  Bitbucket Server Integration Plugin allows bypassing CSRF protection for any URL

  Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins.

  Jenkins Project Jenkins Bitbucket Server Integration Plugin io.jenkins.plugins:atlassian-bitbucket-server-integration Web / CMS Maven
  Jan 22, 2025
• High 8.8
  CVE-2025-24399

  Improper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin

  Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as…

  Jenkins Project Jenkins OpenId Connect Authentication Plugin org.jenkins-ci.plugins:oic-auth Web / CMS Maven
  Jan 22, 2025
• Medium 6.8
  CVE-2025-24401

  Disabled permissions can be granted by Folder-based in Jenkins Authorization Strategy Plugin

  Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to acces…

  Jenkins Project Jenkins Folder-based Authorization Strategy Plugin io.jenkins.plugins:folder-auth Web / CMS Maven
  Jan 22, 2025
• Medium 4.3
  CVE-2025-0142

  Zoom Jenkins Marketplace plugin - Cleartext Storage of Sensitive Information

  Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of information via network access.

  Zoom Communications Zoom Jenkins Marketplace plugin io.jenkins.plugins:zoom Web / CMS Maven
  Jan 30, 2025
• Medium 4.3
  CVE-2025-24397

  Incorrect permission check in Jenkins GitLab Plugin allows enumerating credentials IDs

  An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credential IDs of GitLab API token and Secret text cre…

  Jenkins Project Jenkins GitLab Plugin org.jenkins-ci.plugins:gitlab-plugin Web / CMS Maven
  Jan 22, 2025
• Medium 4.3
  CVE-2025-24400

  Cache confusion in Jenkins Eiffel Broadcaster Plugin

  Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during signing operations, allowing attackers able to create a credential with the same ID as a legitimate one in a different credentials store to …

  Jenkins Project Jenkins Eiffel Broadcaster Plugin com.axis.jenkins.plugins.eiffel:eiffel-broadcaster Web / CMS Maven
  Jan 22, 2025
• Medium 4.3
  CVE-2025-24402

  CSRF vulnerability in Jenkins Azure Service Fabric Plugin

  A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers to connect to a Service Fabric URL using attacker-specified credentials IDs obtained through another method.

  Jenkins Project Jenkins Azure Service Fabric Plugin org.jenkins-ci.plugins:service-fabric Web / CMS Maven
  Jan 22, 2025
• Medium 4.3
  CVE-2025-24403

  Missing permission checks in Jenkins Azure Service Fabric Plugin

  A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of Azure credentials stored in Jenkins.

  Jenkins Project Jenkins Azure Service Fabric Plugin org.jenkins-ci.plugins:service-fabric Web / CMS Maven
  Jan 22, 2025

Revision history

1. 2025-01-22 #1

   Initiale Fassung

References

• Jenkins Security Advisory 2025-01-22 vom 2025-01-22
  https://www.jenkins.io/security/advisory/2025-01-22/