Alvaro Muñoz

**Name of the Vulnerable Software and Affected Versions** Kubernetes versions prior to 3385 **Description** The issue arises from the user-controlled `role` parameter entering the application in the Kubernetes::RoleVerificationsController. This parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parse file method, where it is unsafely deserialized using the YAML.load stream method. This may lead to Remote Code Execution (RCE). **Recommendations** For versions prior to 3385, update to version 3385 or later to resolve the issue. As a temporary workaround, consider restricting access to the Kubernetes::RoleVerificationsController to minimize the risk of exploitation. Avoid using the `role` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Jenkins Blue Ocean Plugin versions 1.27.5 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job. This issue is due to an incomplete fix and results from not requiring POST requests for an HTTP endpoint. The vulnerability enables attackers to exploit the `HTTP endpoint` and capture sensitive information. **Recommendations** For Jenkins Blue Ocean Plugin versions 1.27.5 and earlier, update to a version that includes the complete fix for the issue, such as version 1.27.5.1, which uses the configured SCM URL instead of a user-specified URL. As a temporary workaround, consider restricting access to the vulnerable HTTP endpoint until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin versions 1.14 and earlier **Description** The issue is related to insufficient protection of registration data, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This is due to the plugin not setting the appropriate context for credentials lookup. Attackers can exploit this to gain unauthorized access to protected information. **Recommendations** For Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin versions 1.14 and earlier, as a temporary workaround, consider restricting access to the plugin until a patch is available. Additionally, limit the use of System-scoped credentials to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins GitLab Authentication Plugin versions 1.17.1 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to trick users into logging in to the attacker's account. This issue arises because the plugin does not implement a state parameter in its OAuth flow, which is a unique and non-guessable value associated with each authentication request. **Recommendations** For Jenkins GitLab Authentication Plugin versions 1.17.1 and earlier, update to version 1.18 or later, which implements a state parameter in its OAuth flow.

**Name of the Vulnerable Software and Affected Versions** Jenkins Benchmark Evaluator Plugin versions 1.0.1 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system. This issue arises because the plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to exploit this vulnerability. Furthermore, the form validation method does not require POST requests, contributing to the CSRF vulnerability. **Recommendations** For Jenkins Benchmark Evaluator Plugin versions 1.0.1 and earlier, consider disabling the form validation method temporarily until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of attackers connecting to attacker-specified URLs and checking for file existence on the Jenkins controller file system. Avoid using the plugin's features that do not require POST requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins Sumologic Publisher Plugin versions 2.2.1 and earlier **Description** A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL. This issue also results in a cross-site request forgery (CSRF) vulnerability, as the form validation method does not require POST requests. **Recommendations** For Jenkins Sumologic Publisher Plugin versions 2.2.1 and earlier, consider disabling the plugin until a patch is available to prevent attackers from connecting to an attacker-specified URL. Restrict access to the plugin's form validation method to minimize the risk of exploitation. Avoid using the plugin with Overall/Read permission until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins Sumologic Publisher Plugin versions 2.2.1 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL. The issue arises from a lack of permission check in a method implementing form validation, which can be exploited by attackers with Overall/Read permission. Furthermore, the form validation method does not require POST requests, contributing to the CSRF vulnerability. **Recommendations** For Jenkins Sumologic Publisher Plugin versions 2.2.1 and earlier, consider disabling the form validation method until a patch is available to prevent exploitation. Restrict access to the plugin to minimize the risk of attackers connecting to attacker-specified URLs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins Test Results Aggregator Plugin versions 1.2.13 and earlier **Description** A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials, including `username` and `password`. This issue also results in a cross-site request forgery (CSRF) vulnerability, as the affected HTTP endpoint does not require POST requests. **Recommendations** For Jenkins Test Results Aggregator Plugin versions 1.2.13 and earlier, consider disabling the affected HTTP endpoint until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of attackers connecting to attacker-specified URLs using attacker-specified credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins Test Results Aggregator Plugin versions 1.2.13 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials. This issue arises because the plugin does not perform a permission check in an HTTP endpoint implementing form validation, allowing attackers with Overall/Read permission to exploit this vulnerability. The HTTP endpoint is also vulnerable because it does not require POST requests. **Recommendations** For Jenkins Test Results Aggregator Plugin versions 1.2.13 and earlier, consider disabling the HTTP endpoint implementing form validation until a patch is available to prevent exploitation. Restrict access to the plugin's form validation functionality to minimize the risk of CSRF attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins mabl Plugin versions 0.0.46 and earlier **Description** A missing permission check in the Jenkins mabl Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. The plugin does not perform permission checks in several HTTP endpoints, which also results in a cross-site request forgery (CSRF) vulnerability due to not requiring POST requests. **Recommendations** For Jenkins mabl Plugin versions 0.0.46 and earlier, update to version 0.0.47 or later, which requires POST requests and the appropriate permissions for the affected HTTP endpoints. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins Datadog Plugin versions 5.4.1 and earlier **Description** A missing permission check in the Jenkins Datadog Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. The issue is related to an HTTP endpoint that does not perform a permission check, enabling attackers to exploit this vulnerability. **Recommendations** For Jenkins Datadog Plugin versions 5.4.1 and earlier, update to version 5.4.2 or later, which requires Overall/Administer permission to access the affected HTTP endpoint, thereby mitigating the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins Orka by MacStadium Plugin versions 1.33 and earlier **Description** A missing permission check in the Jenkins Orka by MacStadium Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified `credentials IDs` obtained through another method, capturing credentials stored in Jenkins. The issue is related to an HTTP endpoint that does not perform a permission check, enabling attackers to exploit this weakness. **Recommendations** For Jenkins Orka by MacStadium Plugin versions 1.33 and earlier, update to version 1.34 or later, which requires Overall/Administer permission to access the affected HTTP endpoint. As a temporary workaround, consider restricting access to the affected HTTP endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins ElasticBox CI Plugin versions 5.0.1 and earlier **Description** A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. The plugin does not perform permission checks in several HTTP endpoints, which also results in a cross-site request forgery (CSRF) vulnerability, as these endpoints do not require POST requests. **Recommendations** For Jenkins ElasticBox CI Plugin versions 5.0.1 and earlier, consider disabling the plugin until a patch is available to prevent attackers from exploiting the missing permission check and CSRF vulnerability. Restrict access to the affected HTTP endpoints to minimize the risk of exploitation. Avoid using the plugin with Overall/Read permission to reduce the attack surface. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins ElasticBox CI Plugin versions 5.0.1 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. The vulnerability is also characterized by a lack of permission checks in several HTTP endpoints, which can be exploited by attackers with Overall/Read permission. Additionally, these endpoints do not require POST requests, contributing to the CSRF vulnerability. **Recommendations** For Jenkins ElasticBox CI Plugin versions 5.0.1 and earlier, update to a version that includes the necessary permission checks and CSRF protections. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation. Restrict the use of attacker-specified credentials IDs to prevent capturing credentials stored in Jenkins. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins Benchmark Evaluator Plugin versions 1.0.1 and earlier **Description** A missing permission check in the Jenkins Benchmark Evaluator Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system. This issue also results in a cross-site request forgery (CSRF) vulnerability due to the form validation method not requiring POST requests. **Recommendations** For Jenkins Benchmark Evaluator Plugin versions 1.0.1 and earlier, consider disabling the form validation method until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of attackers connecting to attacker-specified URLs and checking for file existence on the Jenkins controller file system.

**Name of the Vulnerable Software and Affected Versions** Jenkins Template Workflows Plugin versions 41.v32d86a 313b 4a and earlier **Description** The issue results in a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin does not escape names of jobs used as building blocks for Template Workflow Job. Attackers who can create jobs may exploit this vulnerability. **Recommendations** For Jenkins Template Workflows Plugin versions 41.v32d86a 313b 4a and earlier, consider disabling the Template Workflow Job feature until a patch is available to prevent exploitation of the stored cross-site scripting vulnerability. Restrict access to job creation to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins Sonargraph Integration Plugin versions 5.0.1 and earlier **Description** The issue is related to a stored cross-site scripting vulnerability. It occurs because the file path and the project name for the Log file field form validation are not correctly escaped. This vulnerability can be exploited by attackers with Item/Configure permission. **Recommendations** For Jenkins Sonargraph Integration Plugin versions 5.0.1 and earlier, update to a version that correctly escapes the file path and the project name for the Log file field form validation to prevent stored cross-site scripting attacks. As a temporary workaround, consider restricting access to the Log file field form validation for users with Item/Configure permission until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Jenkins Code Dx Plugin versions 3.1.0 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL. The issue arises from the lack of permission checks in several HTTP endpoints, which can be exploited by attackers with Overall/Read permission. These endpoints also do not require POST requests, contributing to the vulnerability. **Recommendations** For Jenkins Code Dx Plugin versions 3.1.0 and earlier, update to version 4.0.0, which requires POST requests and the appropriate permissions for the affected HTTP endpoints. As a temporary workaround, consider restricting access to the affected HTTP endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jenkins AppSpider Plugin versions 1.0.15 and earlier **Description** A cross-site request forgery (CSRF) vulnerability allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials. **Recommendations** For Jenkins AppSpider Plugin versions 1.0.15 and earlier, consider disabling the plugin until a patch is available to prevent exploitation of the CSRF vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nuxeo Platform version 11.5.109 **Description** The Nuxeo Platform is an open source content management platform for building business applications. In the affected version, the `oauth2` REST API is vulnerable to Reflected Cross-Site Scripting (XSS), which can be escalated to Remote Code Execution (RCE) by leveraging the automation API. **Recommendations** For version 11.5.109, consider disabling the `oauth2` REST API until a patch is available to prevent exploitation. Restrict access to the automation API to minimize the risk of Remote Code Execution (RCE).