Stored XSS vulnerability in JUnit Plugin
SECURITY-3032 / CVE-2023-25761
Severity (CVSS): High
Affected plugin: junit
Description:
JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.
JUnit Plugin 1166.1168.vd6b_8042a_06de escapes affected test case class names in JavaScript expressions.
Stored XSS vulnerability in Pipeline: Build Step Plugin
SECURITY-3019 / CVE-2023-25762
Severity (CVSS): High
Affected plugin: pipeline-build-step
Description:
Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
Pipeline: Build Step Plugin 2.18.1 escapes job names in the affected JavaScript expression.
XSS vulnerability in bundled email templates in Email Extension Plugin
SECURITY-2931 / CVE-2023-25763
Severity (CVSS): High
Affected plugin: email-ext
Description:
Email Extension Plugin bundled multiple preconfigured templates for notification emails. The Email Template Testing feature can be used to see what these and other templates would look like based on a given build.
Email Extension Plugin 2.93 and earlier does not escape various fields included in those email templates, like build display name, user display name, and the names of tests.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control affected fields.
Email Extension Plugin 2.93.1 escapes affected fields in bundled email templates.
Stored XSS vulnerability in custom email templates in Email Extension Plugin
SECURITY-2934 / CVE-2023-25764
Severity (CVSS): High
Affected plugin: email-ext
Description:
Email Extension Plugin allows defining custom email templates using Config File Provider plugin as Jelly or Groovy files. The Email Template Testing feature can be used to see what these templates would look like based on a given build by specifying the managed: name prefix.
Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.
Email Extension Plugin 2.93.1 renders email template previews inside a sandboxed iframe.
Script Security sandbox bypass vulnerability in Email Extension Plugin
SECURITY-2939 / CVE-2023-25765
Severity (CVSS): High
Affected plugin: email-ext
Description:
Email Extension Plugin allows defining custom email templates using Config File Provider plugin as Jelly or Groovy files. When defined inside a folder, email templates need to be subject to Script Security protection (sandboxed execution or full-script approval).
In Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection.
This vulnerability allows attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Email templates defined in folders are subject to sandbox protection in Email Extension Plugin 2.93.1.
Missing permission checks in Azure Credentials Plugin allow enumerating credentials IDs
SECURITY-1757 / CVE-2023-25766
Severity (CVSS): Medium
Affected plugin: azure-credentials
Description:
Azure Credentials Plugin 253.v887e0f9e898b and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
An enumeration of credentials IDs in Azure Credentials Plugin 254.v64da_8176c83a requires Overall/Administer permission.
CSRF vulnerability and missing permission checks in Azure Credentials Plugin
SECURITY-1756 / CVE-2023-25767 (CSRF), CVE-2023-25768 (missing permission check)
Severity (CVSS): Medium
Affected plugin: azure-credentials
Description:
Azure Credentials Plugin 253.v887e0f9e898b and earlier does not perform permission checks in methods implementing form validation.
This allows attackers with Overall/Read permission to connect to an attacker-specified web server.
Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
These form validation methods require POST requests and Overall/Administer permission in Azure Credentials Plugin 254.v64da_8176c83a.
Missing permission checks in Synopsys Coverity Plugin allow enumerating credentials IDs
SECURITY-2793 (1) / CVE-2023-23850
Severity (CVSS): Medium
Affected plugin: synopsys-coverity
Description:
Synopsys Coverity Plugin 3.0.2 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
An enumeration of credentials IDs in Synopsys Coverity Plugin 3.0.3 requires the appropriate permissions.
CSRF vulnerability and missing permission checks in Synopsys Coverity Plugin allow capturing credentials
SECURITY-2793 (2) / CVE-2023-23847 (CSRF), CVE-2023-23848 (missing permission check)
Severity (CVSS): High
Affected plugin: synopsys-coverity
Description:
Synopsys Coverity Plugin 3.0.2 and earlier does not perform permission checks in several HTTP endpoints.
This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Synopsys Coverity Plugin 3.0.3 requires POST requests and the appropriate permissions for the affected HTTP endpoints.