This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Jenkins fixes 7 vulnerabilities in plugins
Jenkins is fixing 7 vulnerabilities in its plugins [1]. Plugins and fixed versions [1]: Authorize Project Plugin - 1.8.0 IvyTrigger Plugin - 1.02 OpenId Connect Authentication Plugin - 4.421.v5422614eb_e0a_ Declarative Plugin - 2.2218.v56d0cda_37c72 Groovy Plugin - 3993.v3e20a_37282f8 Script Security Plugin - 1368.vb_b_402e3547e7 Shared Library Version Override Plugin - 19.v3a_c975738d4a_
Allows an authenticated remote attacker with Item/Configure permission in the Shared Library Version Override plugin to configure a folder-level library override that is executed without sandbox protection [1].
The vulnerability is present in product:
- Shared Library Version Override Plugin;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-52554 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
Allows an unauthenticated remote attacker in the OpenId Connect Authentication plugin to use social engineering techniques to gain administrator access to Jenkins, because the plugin does not terminate the existing session on login [1].
The vulnerability is present in product:
- OpenId Connect Authentication Plugin;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-52553 at cve.org, NVD
- CWE-613: Insufficient Session Expiration at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
Allows an authenticated remote attacker with Item/Configure permission in the Authorize Project plugin to carry out a stored XSS attack [1].
The vulnerability is present in product:
- Authorize Project Plugin;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-52552 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
Allows an authenticated remote attacker with Item/Build permission in the Declarative plugin to restart a previous build whose script (Jenkinsfile) is no longer approved [1].
The vulnerability is present in product:
- Declarative Plugin;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-52551 at cve.org, NVD
- CWE-276: Incorrect Default Permissions at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
Allows an authenticated remote attacker with Item/Build permission in the Groovy plugin to restore a previous build whose script (Jenkinsfile) is no longer approved [1].
The vulnerability is present in product:
- Groovy Plugin;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-52550 at cve.org, NVD
- CWE-276: Incorrect Default Permissions at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
Allows an authenticated remote attacker controlling build input files in the IvyTrigger plugin to use an XML document with external entities to extract secrets from the Jenkins controller or to perform server-side request forgery [1].
The vulnerability is present in product:
- IvyTrigger Plugin;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
More information:
- CVE-2022-46751 at cve.org, NVD
- CWE-91: XML Injection (aka Blind XPath Injection) at cwe.mitre.org
- CWE-611: Improper Restriction of XML External Entity Reference at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
Allows an authenticated remote attacker with Overall/Read permission in the Script Security plugin to check for the existence of files on the controller's file system [1].
The vulnerability is present in product:
- Script Security Plugin;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2024-52549 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
By CESNET, z.s.p.o. Michaela Jarošová on 21. 11. 2024.