CloudBees Security Advisory 2017-12-05

This advisory announces multiple vulnerabilities in Jenkins, CloudBees Jenkins Platform and CloudBees Jenkins Solutions.

Stored XSS vulnerability in tool names exploitable by administrators

SECURITY-624

Jenkins administrators can configure tools, such as JDK, Maven, or Ant, that will be available in job configurations for use by build scripts. Some tool names are not properly escaped on job configuration forms, resulting in a stored cross-site scripting vulnerability.

Tools confirmed to be affected are:

  • JDK (provided by Jenkins core)

  • Ant (provided by Ant plugin)

Others may also be affected by this.

Please be aware that this vulnerability can only be exploited by Jenkins administrators, as they’re the only ones able to define tools. In regular Jenkins configurations, administrators are able to run any code and install any plugin. Therefore this vulnerability only really affects installations that don’t grant administrators the Run Scripts, Configure Update Sites, and/or Install Plugins permissions.

Severity

All versions of Jenkins, CloudBees Jenkins Platform, and CloudBees Jenkins Solutions are affected.

Fix

As of publication of this advisory, there is no fix available.

More Security Advisories

Continuously redefine what’s possible through software

© 2024 CloudBees, Inc., CloudBees® and the Infinity logo® are registered trademarks of CloudBees, Inc. in the United States and may be registered in other countries. Other products or brand names may be trademarks or registered trademarks of CloudBees, Inc. or their respective holders.
Terms of Service