Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code or (2) initiate deployment of binaries to a Maven repository via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1,
    and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the
    authentication of administrators for requests that (1) execute arbitrary code or (2) initiate deployment
    of binaries to a Maven repository via unspecified vectors. (CVE-2013-2034)

The remote web server hosts a version of Jenkins or Jenkins Enterprise that is affected by multiple vulnerabilities :

  - The included component 'ZeroClipboard' contains an     error in the file 'ZeroClipboard10.swf' that could     allow cross-site scripting attacks.
    (CVE-2013-1808)

  - An unspecified cross-site scripting error exists.
    (CVE-2013-2033)

  - Multiple errors exist that could lead to cross-site     request forgery attacks, thus allowing an attacker to     trick an administrator into executing arbitrary code.
    (CVE-2013-2034)

Jenkins Security Advisory reports :

This advisory announces multiple security vulnerabilities that were found in Jenkins core.

- SECURITY-63 / CVE-2013-2034

This creates a cross-site request forgery (CSRF) vulnerability on Jenkins master, where an anonymous attacker can trick an administrator to execute arbitrary code on Jenkins master by having him open a specifically crafted attack URL.

There's also a related vulnerability where the permission check on this ability is done imprecisely, which may affect those who are running Jenkins instances with a custom authorization strategy plugin.

- SECURITY-67 / CVE-2013-2033

This creates a cross-site scripting (XSS) vulnerability, where an attacker with a valid user account on Jenkins can execute JavaScript in the browser of other users, if those users are using certain browsers.

- SECURITY-69 / CVE-2013-2034

This is another CSRF vulnerability that allows an attacker to cause a deployment of binaries to Maven repositories. This vulnerability has the same CVE ID as SEUCRITY-63.

- SECURITY-71 / CVE-2013-1808

This creates a cross-site scripting (XSS) vulnerability.

ID	Name	Product	Family	Severity
414495	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-fg4r-f9j2-36mw)	Tenable Cloud Security	SCA Checks	high
414495	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-fg4r-f9j2-36mw)	Tenable Self-Hosted Container Security	SCA Checks	high
66898	Jenkins < 1.514 / 1.509.1 and Jenkins Enterprise 1.466.x / 1.480.x < 1.466.14.1 / 1.480.4.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
66311	FreeBSD : jenkins -- multiple vulnerabilities (622e14b1-b40c-11e2-8441-00e0814cab4e)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-2034

high

Tenable Plugins

high

high

medium

medium