Julien Szlamowicz

The issue is related to the mishandling of sendXML actions by the FusionInventory plugin.

Name of the Vulnerable Software and Affected Versions: Jenkins Job Import Plugin versions 2.1 and earlier Description: The issue allows attackers with control over the HTTP server queried in preparation of job import to read arbitrary files and perform a denial of service attack. This is due to an XML external entity processing vulnerability in the src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java file. Recommendations: For Jenkins Job Import Plugin versions 2.1 and earlier, update to a version later than 2.1 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Jenkins Job Import Plugin versions 2.1 and earlier Description: A sensitive information exposure issue exists, allowing attackers with Overall/Read permission to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored in Jenkins. This is due to the plugin not checking user permissions on its API endpoint used to access remote Jenkins instances. The issue enables users with Overall/Read access to Jenkins to connect to an attacker-specified URL, potentially leading to credential capture. Recommendations: For Jenkins Job Import Plugin versions 2.1 and earlier, update to version 3.0 or later, which will only access Jenkins instances using credentials defined in the global configuration. As a temporary workaround, consider restricting access to the plugin's API endpoint to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Jenkins GitHub Authentication Plugin versions 0.29 and earlier Description: An exposure of sensitive information issue exists that allows attackers, who can view a Jenkins administrator's web browser output or control the browser, to retrieve the configured client secret. This can occur through the GithubSecurityRealm/config.jelly file. Recommendations: For Jenkins GitHub Authentication Plugin versions 0.29 and earlier, update to a version later than 0.29 to resolve the issue. As a temporary workaround, consider restricting access to the GithubSecurityRealm/config.jelly file to minimize the risk of exploitation.