Yaroslav Afenkin

لا يقوم المكون الإضافي Jenkins Redpen - Pipeline Reporter for Jira بالتحقق بشكل كافٍ من صحة مسارات الملفات داخل دليل مساحة العمل أثناء تحميل العناصر إلى Jira. وهذا يسمح للمستخدمين الذين يتمتعون بأذونات «Item/Configure» بالوصول إلى الملفات الموجودة في دليل مساحة عمل وحدة التحكم Jenkins. تنشأ المشكلة عن عدم كفاية التحقق من صحة المسار، مما قد يسمح باسترداد الملفات دون إذن.

تتعلق المشكلة بفحص غير صحيح للأذونات في مكوّن Jenkins GitLab الإضافي. وهذا يسمح للمهاجمين الذين يمتلكون أذونات عامة من نوع «Item/Configure»، ولكن دون أذونات «Item/Configure» في أي مهمة محددة، بتعداد معرّفات بيانات اعتماد رمز GitLab API وبيانات الاعتماد النصية السرية المخزنة في Jenkins. ويمكن استخدام معرّفات بيانات الاعتماد هذه كجزء من هجوم لسرقة بيانات الاعتماد باستخدام ثغرة أمنية أخرى.

تسمح هذه المشكلة نظريًا للمستخدمين الذين مُنحوا سابقًا أذونات معينة بالوصول إلى وظائف لم يعد لهم الحق في الوصول إليها، لأن المكون الإضافي لا يتحقق مما إذا كانت الأذونات المُعدة قيد التفعيل أم لا. ويشمل ذلك عادةً الأذونات الاختيارية.

The global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections does not take effect until Jenkins is restarted when switching from disabled validation to enabled validation.

The issue results in a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin does not sanitize iceScrum project URLs on build views. Attackers who can configure jobs may exploit this.

The issue is related to the use of a non-constant time comparison function when checking whether the provided and expected webhook token are equal. This potentially allows attackers to use statistical methods to obtain a valid webhook token, which could lead to unauthorized access to confidential information.

A cross-site request forgery (CSRF) vulnerability exists due to the lack of permission checks in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified `username` and `password`. This endpoint also does not require POST requests, further contributing to the vulnerability.

A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified `username` and `password`. The connection test HTTP endpoint is vulnerable, and it does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

The issue results in a stored cross-site scripting (XSS) vulnerability because the Trac website URL on the build page is not escaped. This vulnerability is exploitable by attackers with Item/Configure permission.

The issue is related to the use of a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal. This potentially allows attackers to use statistical methods to obtain a valid webhook token.

The issue is related to information disclosure. It potentially allows a remote attacker to gain unauthorized access to protected information. The problem lies in the non-constant time comparison function used when checking the provided and expected webhook token for equality. This could allow attackers to use statistical methods to obtain a valid webhook token.

The issue is related to information disclosure. It may allow a remote attacker to gain unauthorized access to protected information. The problem lies in the non-constant time comparison function used when checking the provided and expected webhook token for equality. This potentially allows attackers to use statistical methods to obtain a valid webhook token.

The issue results in a stored cross-site scripting (XSS) vulnerability. This occurs because the GitHub project URL on the build page is not properly escaped when showing changes. Attackers with Item/Configure permission can exploit this vulnerability.

The issue is related to the lack of escaping of the `caption` constructor parameter value of `ExpandableDetailsNote`, resulting in a stored cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers who can control this parameter, potentially allowing them to manage files in workspaces. The `ExpandableDetailsNote` feature allows annotating build log content with additional information that can be revealed when interacted with.

The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the Jenkins Build Failure Analyzer Plugin does not escape Failure Cause names in build logs. This makes it exploitable by attackers who can create or update Failure Causes.

The issue is related to a non-constant time comparison function used when checking whether the provided and expected CSRF protection nonce are equal. This potentially allows attackers to use statistical methods to obtain a valid nonce.

The issue is related to the verification of permissions configured to be granted. It potentially allows users who were formerly granted certain permissions, such as Overall/Manage, to access functionality they are no longer entitled to. This is because the plugin does not verify that these permissions are enabled.

The issue concerns the Jenkins Pipeline Maven Integration Plugin, which does not properly mask usernames of credentials specified in custom Maven settings in Pipeline build logs when "Treat username as secret" is checked. This affects the security of credentials by potentially exposing them in the build logs.

The issue results in users with EDIT permissions being granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted. This occurs because the plugin does not verify that the permissions it grants are enabled.

A cross-site request forgery (CSRF) vulnerability allows attackers to connect to Frugal Testing using attacker-specified credentials, and to retrieve test IDs and names from Frugal Testing, if a valid credential corresponds to the attacker-specified username.