Andrea Chiera

**Name of the Vulnerable Software and Affected Versions** Jenkins Scriptler Plugin versions 342.v6a 89fd40f466 and earlier **Description** A missing permission check in the Jenkins Scriptler Plugin allows attackers with Overall/Read permission to read the contents of a Groovy script by knowing its ID. **Recommendations** For Jenkins Scriptler Plugin versions 342.v6a 89fd40f466 and earlier, consider restricting access to the plugin or limiting the Overall/Read permission to minimize the risk of exploitation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Jenkins PaaSLane Estimate Plugin versions 1.0.4 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL using an attacker-specified token. **Recommendations** For Jenkins PaaSLane Estimate Plugin versions 1.0.4 and earlier, consider disabling the plugin until a patch is available to prevent exploitation of the CSRF vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins PaaSLane Estimate Plugin versions 1.0.4 and earlier **Description** The issue concerns the Jenkins PaaSLane Estimate Plugin, where PaaSLane authentication tokens are not masked on the job configuration form. This increases the potential for attackers to observe and capture these tokens. **Recommendations** For Jenkins PaaSLane Estimate Plugin versions 1.0.4 and earlier, consider updating to a version that properly masks PaaSLane authentication tokens to prevent potential attackers from observing and capturing them. As a temporary workaround, restrict access to the job configuration form to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier **Description** The issue is related to missing permission checks in the Jenkins Nexus Platform Plugin, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method. This can result in capturing credentials stored in Jenkins. Additionally, the form validation methods in the affected versions do not require POST requests, leading to a cross-site request forgery (CSRF) vulnerability. **Recommendations** For Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier, update to version 3.18.1-01 or later, which requires POST requests and Overall/Administer permission for the affected form validation methods. As a temporary workaround, consider restricting access to the form validation methods to minimize the risk of exploitation. Restrict the use of Overall/Read permission to reduce the attack surface until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. The vulnerability is due to the lack of permission checks in methods implementing form validation, which can be exploited by attackers with Overall/Read permission. Additionally, the form validation methods do not require POST requests, further contributing to the CSRF vulnerability. **Recommendations** For Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier, update to version 3.18.1-01 or later, which requires POST requests and Overall/Administer permission for the affected form validation methods, mitigating the CSRF vulnerability. As a temporary workaround, consider restricting access to the form validation methods to users with Overall/Administer permission until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier **Description** The issue is related to missing permission checks in the Jenkins Nexus Platform Plugin, allowing attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. This also leads to a cross-site request forgery (CSRF) vulnerability due to the lack of requirement for POST requests. Additionally, the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, which can result in the extraction of secrets from the Jenkins controller or server-side request forgery. **Recommendations** For Jenkins Nexus Platform Plugin versions 3.18.0-03 and earlier, update to version 3.18.1-01 or later, which configures its XML parser to prevent XML external entity (XXE) attacks and requires POST requests and Overall/Administer permission for the affected HTTP endpoints. As a temporary workaround, consider restricting access to the plugin's form validation methods to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins MATLAB Plugin versions 2.11.0 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to have Jenkins parse an XML file from the Jenkins controller file system. The plugin determines whether a user-specified directory on the Jenkins controller is the location of a MATLAB installation by parsing an XML file in that directory. The plugin does not perform permission checks in several HTTP endpoints implementing related form validation, and these endpoints do not require POST requests. Additionally, the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers to extract secrets from the Jenkins controller or perform server-side request forgery. **Recommendations** For Jenkins MATLAB Plugin versions 2.11.0 and earlier, update to version 2.11.1 or later, which configures its XML parser to prevent XML external entity (XXE) attacks and requires POST requests and Item/Configure permission for the affected HTTP endpoints. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins MATLAB Plugin versions 2.11.0 and earlier **Description** The issue concerns the Jenkins MATLAB Plugin, which does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows attackers who can create files on the Jenkins controller file system to have Jenkins parse a crafted XML document, potentially leading to the extraction of secrets from the Jenkins controller or server-side request forgery. The plugin also fails to perform permission checks in several HTTP endpoints and does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. **Recommendations** For Jenkins MATLAB Plugin versions 2.11.0 and earlier, update to version 2.11.1 or later, which configures its XML parser to prevent XML external entity (XXE) attacks and requires POST requests and Item/Configure permission for the affected HTTP endpoints. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins MATLAB Plugin versions 2.11.0 and earlier **Description** The issue arises from missing permission checks in the Jenkins MATLAB Plugin, allowing attackers to have Jenkins parse an XML file from the Jenkins controller file system. Specifically, the plugin determines whether a user-specified directory on the Jenkins controller is the location of a MATLAB installation by parsing an XML file in that directory. The plugin does not perform permission checks in several HTTP endpoints implementing related form validation, and these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Furthermore, the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers to extract secrets from the Jenkins controller or perform server-side request forgery. **Recommendations** For Jenkins MATLAB Plugin versions 2.11.0 and earlier, update to version 2.11.1 or later, which configures its XML parser to prevent XML external entity (XXE) attacks and requires POST requests and Item/Configure permission for the affected HTTP endpoints. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins Jira Plugin versions 3.11 and earlier **Description** The issue is related to insufficient access control due to incorrect context definition for credentials lookup. This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to. The exploitation of this issue can enable a remote attacker to gain unauthorized access to protected information. **Recommendations** For Jenkins Jira Plugin versions 3.11 and earlier, update to version 3.12 or later, which defines the appropriate context for credentials lookup, to resolve the issue. As a temporary workaround, consider restricting access to the `Item/Configure` permission to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins CloudBees CD Plugin versions 1.1.32 and earlier **Description** The issue is related to the handling of symbolic links during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step. This allows attackers who can configure jobs to delete arbitrary files on the Jenkins controller file system. The vulnerability is caused by the plugin following symbolic links to locations outside of the expected directory. **Recommendations** For Jenkins CloudBees CD Plugin versions 1.1.32 and earlier, update to version 1.1.33 or later, which deletes symbolic links without following them, thus resolving the issue.

**Name of the Vulnerable Software and Affected Versions** Jenkins lambdatest-automation Plugin versions 1.20.9 and earlier **Description** A missing permission check in the Jenkins lambdatest-automation Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of LAMBDATEST credentials stored in Jenkins. This can be used as part of an attack to capture the credentials using another vulnerability. The issue is related to an HTTP endpoint that does not perform a permission check. **Recommendations** For Jenkins lambdatest-automation Plugin versions 1.20.9 and earlier, update to version 1.20.10 or later, which requires Overall/Administer permission to enumerate credentials IDs, mitigating the issue. As a temporary workaround, consider restricting access to the plugin's HTTP endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins lambdatest-automation Plugin versions 1.20.10 and earlier **Description** The issue is related to the exposure of information. It potentially allows a remote attacker to gain unauthorized access to protected information. The problem arises because the plugin logs LAMBDATEST Credentials access token at the INFO level, which could result in accidental exposure of the token through the default system log. **Recommendations** For Jenkins lambdatest-automation Plugin versions 1.20.10 and earlier, update to version 1.21.0 or later, which no longer logs the LAMBDATEST Credentials access token.

**Name of the Vulnerable Software and Affected Versions** Jenkins Warnings Plugin versions 10.5.0 and earlier **Description** The issue is related to information disclosure, allowing remote attackers to gain unauthorized access to protected information. Specifically, it does not set the appropriate context for credentials lookup, enabling attackers with Item/Configure permission to access and capture credentials they are not entitled to. This allows the use of system-scoped credentials otherwise reserved for the global configuration. **Recommendations** For Jenkins Warnings Plugin versions 10.5.0 and earlier, update to version 10.5.1 or later, or apply the backported fix to version 10.4.1, to define the appropriate context for credentials lookup and prevent unauthorized access to credentials. As a temporary workaround, consider restricting access to the credentials lookup functionality for users with Item/Configure permission until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified hostname and port using attacker-specified `username` and `password`. This issue arises because the plugin does not perform a permission check in a connection test HTTP endpoint, and this endpoint does not require POST requests. Attackers with Overall/Read permission can exploit this vulnerability. **Recommendations** For Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier, update to version 2.4.2 or later, which requires POST requests and Overall/Administer permission for the affected HTTP endpoint, thus mitigating the CSRF vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier **Description** A missing permission check in the Jenkins Build Failure Analyzer Plugin allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified `username` and `password`. This issue also results in a cross-site request forgery (CSRF) vulnerability due to the lack of requirement for POST requests in a connection test HTTP endpoint. **Recommendations** For Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier, update to version 2.4.2 or later, which requires POST requests and Overall/Administer permission for the affected HTTP endpoint, thus mitigating the issue. As a temporary workaround, consider restricting access to the connection test HTTP endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins Build Failure Analyzer Plugin versions 2.4.1 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to delete Failure Causes. This issue arises because the plugin does not require POST requests for a specific HTTP endpoint, making it vulnerable to CSRF attacks. **Recommendations** For versions 2.4.1 and earlier, update to version 2.4.2 or later, which requires POST requests for the affected HTTP endpoint, thus mitigating the CSRF vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins Job Configuration History Plugin versions 1227.v7a 79fc4dc01f and earlier **Description** The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the timestamp value from history entries is not properly sanitized or escaped when rendering a history entry on the history view. This allows for malicious scripts to be stored and executed, potentially leading to security breaches. **Recommendations** For Jenkins Job Configuration History Plugin versions 1227.v7a 79fc4dc01f and earlier, consider disabling the rendering of history entries on the history view until a patch is available. Restrict access to the history view to minimize the risk of exploitation. Avoid using the timestamp value from history entries in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins TAP Plugin versions 2.3 and earlier **Description** The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the Jenkins TAP Plugin does not escape TAP file contents, making it exploitable by attackers who can control TAP file contents. **Recommendations** For versions 2.3 and earlier, update to a version that fixes the stored cross-site scripting vulnerability. As a temporary workaround, consider restricting access to TAP files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins Job Configuration History Plugin versions 1227.v7a 79fc4dc01f and earlier **Description** The issue is related to the configuration of the XML parser in the Jenkins Job Configuration History Plugin, which does not prevent XML external entity (XXE) attacks. This allows for potential exploitation. **Recommendations** For versions 1227.v7a 79fc4dc01f and earlier, consider disabling the XML parser functionality until a patch is available to prevent XXE attacks. Restrict access to the plugin's configuration to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.