Daniel Beck

A missing permission check allows attackers with View/Read permission to view encrypted password values in views.

Jenkins does not perform a permission check for the authenticated user profile dropdown menu. This allows attackers without Overall/Read permission to obtain limited information about the Jenkins configuration by listing available options in this menu, such as whether the Credentials Plugin is installed.

The Jenkins global-build-stats Plugin does not perform permission checks in its REST API endpoints. Attackers with Overall/Read permission can enumerate graph IDs.

The Git URL field form validation responses differ based on whether the specified file path exists on the Jenkins controller when using the `amazon-s3` protocol with JGit. This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

The issue allows users who can change report content to exploit a cross-site scripting (XSS) vulnerability due to the manner in which Gatling reports are served, bypassing the Content-Security-Policy protection introduced in certain Jenkins versions.

Name of the Vulnerable Software and Affected Versions: Jenkins Health Advisor by CloudBees Plugin versions 374.v194b d4f0c8c8 and earlier Description: The issue results in a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin does not escape responses from the Jenkins Health Advisor server, making it exploitable by attackers who can control these responses. Recommendations: For versions 374.v194b d4f0c8c8 and earlier, update to a version that properly escapes responses from the Jenkins Health Advisor server to prevent stored XSS attacks.

A missing permission check in Jenkins allows attackers with `Computer/Create` permission but without `Computer/Extended Read` permission to copy an agent, gaining access to its configuration.

A missing permission check in Jenkins allows attackers with `Computer/Create` permission but without `Computer/Configure` permission to copy an agent, gaining access to encrypted secrets in its configuration.

The issue allows attackers with View/Read permission to view encrypted values of secrets when accessing `config.xml` of views via REST API or CLI. This occurs because Jenkins does not redact encrypted values of secrets in the specified versions.

The issue allows attackers with Agent/Extended Read permission to view encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI. This is because Jenkins does not redact encrypted values of secrets in these scenarios. Attackers may potentially store attacker-controlled content in other users' profiles.

Name of the Vulnerable Software and Affected Versions: Jenkins Filesystem List Parameter Plugin versions 0.0.14 and earlier Description: The issue allows attackers with Item/Configure permission to enumerate file names on the Jenkins controller file system due to a lack of restriction on the path used for the File system objects list Parameter. Recommendations: For Jenkins Filesystem List Parameter Plugin versions 0.0.14 and earlier, update to version 0.0.15 or later, which restricts paths used by the File system objects list Parameter to an allow list, with the default base directory set to $JENKINS HOME/userContent/. Additionally, consider configuring the allow list to include custom base directories as needed.

The issue allows attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection, as these overrides are declared as trusted and not executed in the Script Security sandbox. This could potentially be exploited by attackers to run malicious code without the protection of the sandbox.

The issue arises from a lack of permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views". Additionally, attackers with global View/Configure and View/Delete permissions can modify other users' "My Views".

The issue arises from the lack of path validation of the workspace directory while serving report files, leading to a path traversal vulnerability. This allows attackers with Item/Configure permission to retrieve sensitive information, including Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors, from the controller file system by manipulating the workspace path. Additionally, the Report Info Plugin does not support distributed builds.

The issue is related to a lack of permission check for read access to a Git repository over SSH. Attackers with a previously configured SSH public key but lacking Overall/Read permission can access these repositories. This allows unauthorized access to Git repositories.

The issue arises when a build is triggered from a release tag, causing the plugin to programmatically set the Java system property `hudson.model.ParametersAction.keepUndefinedParameters`. This action disables a previously implemented fix. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

A missing permission check in an HTTP endpoint allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions.

A cross-site request forgery issue allows attackers to connect to a specified TCP or Unix socket URL and reconfigure the plugin, affecting future build step executions.

The issue concerns the logging of potentially sensitive build parameters as part of debug information in build logs by default.

The issue concerns a global option in the Jenkins Delphix Plugin that allows administrators to enable or disable SSL/TLS certificate validation for Data Control Tower (DCT) connections. This option is disabled by default.