Yaroslav Afenkin

O Plugin Jenkins Redpen - Pipeline Reporter for Jira não valida adequadamente os caminhos de arquivo dentro do diretório de workspace durante o upload de artefatos para o Jira. Isso permite que usuários com permissões de Item/Configure acessem arquivos localizados no diretório de workspace do controller Jenkins. O problema decorre de validação de caminho insuficiente, potencialmente permitindo a recuperação não autorizada de arquivos.

O problema está relacionado a uma verificação de permissão incorreta no Plugin Jenkins GitLab. Isso permite que atacantes com permissão global Item/Configure, mas sem permissão Item/Configure em qualquer job específico, enumerem os IDs de credenciais de token da API do GitLab e credenciais de texto secreto armazenadas no Jenkins. Esses IDs de credenciais podem ser usados como parte de um ataque para capturar as credenciais utilizando outra vulnerabilidade.

O problema potencialmente permite que usuários aos quais foram anteriormente concedidas certas permissões acessem funcionalidades às quais não têm mais direito, porque o plugin não verifica se as permissões configuradas estão habilitadas. Isso geralmente envolve permissões opcionais.

A opção global que permite aos administradores ativar ou desativar a validação de certificados SSL/TLS para conexões com o Data Control Tower (DCT) só entra em vigor após a reinicialização do Jenkins ao mudar da validação desativada para a ativada.

A falha resulta em uma vulnerabilidade de script entre sites (XSS) armazenada. Isso ocorre porque o plugin não sanitiza as URLs dos projetos iceScrum nas visualizações de compilação. Invasores com permissão para configurar tarefas podem explorar essa vulnerabilidade.

O problema está relacionado ao uso de uma função de comparação de tempo não constante ao verificar se o token de webhook fornecido e o esperado são iguais. Isso permite, potencialmente, que invasores utilizem métodos estatísticos para obter um token de webhook válido, o que poderia levar ao acesso não autorizado a informações confidenciais.

A cross-site request forgery (CSRF) vulnerability exists due to the lack of permission checks in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified `username` and `password`. This endpoint also does not require POST requests, further contributing to the vulnerability.

A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified `username` and `password`. The connection test HTTP endpoint is vulnerable, and it does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

The issue results in a stored cross-site scripting (XSS) vulnerability because the Trac website URL on the build page is not escaped. This vulnerability is exploitable by attackers with Item/Configure permission.

The issue is related to the use of a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal. This potentially allows attackers to use statistical methods to obtain a valid webhook token.

The issue is related to information disclosure. It potentially allows a remote attacker to gain unauthorized access to protected information. The problem lies in the non-constant time comparison function used when checking the provided and expected webhook token for equality. This could allow attackers to use statistical methods to obtain a valid webhook token.

The issue is related to information disclosure. It may allow a remote attacker to gain unauthorized access to protected information. The problem lies in the non-constant time comparison function used when checking the provided and expected webhook token for equality. This potentially allows attackers to use statistical methods to obtain a valid webhook token.

The issue results in a stored cross-site scripting (XSS) vulnerability. This occurs because the GitHub project URL on the build page is not properly escaped when showing changes. Attackers with Item/Configure permission can exploit this vulnerability.

The issue is related to the lack of escaping of the `caption` constructor parameter value of `ExpandableDetailsNote`, resulting in a stored cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers who can control this parameter, potentially allowing them to manage files in workspaces. The `ExpandableDetailsNote` feature allows annotating build log content with additional information that can be revealed when interacted with.

The issue is related to a stored cross-site scripting (XSS) vulnerability. It occurs because the Jenkins Build Failure Analyzer Plugin does not escape Failure Cause names in build logs. This makes it exploitable by attackers who can create or update Failure Causes.

The issue is related to a non-constant time comparison function used when checking whether the provided and expected CSRF protection nonce are equal. This potentially allows attackers to use statistical methods to obtain a valid nonce.

The issue is related to the verification of permissions configured to be granted. It potentially allows users who were formerly granted certain permissions, such as Overall/Manage, to access functionality they are no longer entitled to. This is because the plugin does not verify that these permissions are enabled.

The issue concerns the Jenkins Pipeline Maven Integration Plugin, which does not properly mask usernames of credentials specified in custom Maven settings in Pipeline build logs when "Treat username as secret" is checked. This affects the security of credentials by potentially exposing them in the build logs.

The issue results in users with EDIT permissions being granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted. This occurs because the plugin does not verify that the permissions it grants are enabled.

A cross-site request forgery (CSRF) vulnerability allows attackers to connect to Frugal Testing using attacker-specified credentials, and to retrieve test IDs and names from Frugal Testing, if a valid credential corresponds to the attacker-specified username.