Summary
Ein Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, Daten offenzulegen und zu manipulieren, Server-Side Request Forgery (SSRF) durchzuführen, Cross-Site-Scripting-Angriffe auszuführen oder über offene Weiterleitungen Phishing-Angriffe durchzuführen.
Product
Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art.
Vulnerabilities 20
-
High 8.8
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy cre…
-
High 8.8
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null rece…
-
High 8.8
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the ele…
-
High 8.8
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass anno…
-
High 8.8
Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framewo…
-
High 8.0
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an ite…
-
High 8.0
Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job conf…
-
High 8.0
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configura…
-
High 8.0
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the…
-
High 7.5
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirmin…
-
High 7.5
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods…
-
High 7.2
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStra…
-
Medium 6.8
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in…
-
Medium 6.5
Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, includi…
-
Medium 5.4
Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected …
-
Medium 5.4
Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API t…
-
Medium 4.3
Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attac…
-
Medium 4.2
Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to…
-
Medium 4.2
The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the `oauth_call…
-
Low 3.1
Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credential…
Revision history
-
#2
Neue Updates von Red Hat aufgenommen
-
#1
Initiale Fassung
References
-
Jenkins Security Advisory vom 2026-09-16
https://www.jenkins.io/security/advisory/2026-09-16/
-
Red Hat Security Advisory RHSA-2026:88150 vom 2026-10-22
https://access.redhat.com/errata/RHSA-2026:88150