A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2548 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * jenkins: CSRF protection tokens did not expire (CVE-2019-10353)

    * jenkins: Arbitrary file write vulnerability using file parameter definitions (CVE-2019-10352)

    * jenkins: Unauthorized view fragment access (CVE-2019-10354)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2503 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * jenkins: CSRF protection tokens did not expire (CVE-2019-10353)

    * jenkins: Arbitrary file write vulnerability using file parameter definitions (CVE-2019-10352)

    * jenkins: Unauthorized view fragment access (CVE-2019-10354)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Jenkins running on the remote web server is prior to 2.186 or is a version of Jenkins LTS prior to 2.176.2. It is, therefore, affected by multiple vulnerabilities:

  - An arbitrary file write vulnerability exists due to an incomplete fix for SECURITY-1074, the improper     validation of the file parameter definition. An authenticated, remote attacker can exploit this, via a     file name with a relative path escaping the base directory, to write arbitrary files on the remote host.
    (CVE-2019-10352)

  - A security bypass vulnerability exists due to insufficent validaiton of CSRF tokens. An unauthenticated,     remote attacker can exploit this, after obtaining the CSRF token of another user, to bypass CSRF     protections and implement a CSRF attack. (CVE-2019-10353)

  - An information disclosure vulnerability exists in the Stapler web framework due to inadequit permission     control of view fragments. An authenticated, remote attacker can exploit this, to disclose potentially     sensitive information. (CVE-2019-10354)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Jenkins Security Advisory : Description(Medium) SECURITY-1424 / CVE-2019-10352 Arbitrary file write vulnerability using file parameter definitions (High) SECURITY-626 / CVE-2019-10353 CSRF protection tokens did not expire (Medium) SECURITY-534 / CVE-2019-10354 Unauthorized view fragment access

ID	Name	Product	Family	Severity
128406	RHEL 7 : OpenShift Container Platform 4.1 jenkins (RHSA-2019:2548)	Nessus	Red Hat Local Security Checks	high
127989	RHEL 7 : OpenShift Container Platform 3.11 jenkins (RHSA-2019:2503)	Nessus	Red Hat Local Security Checks	high
127053	Jenkins < 2.176.2 LTS / 2.186 Multiple Vulnerabilities	Nessus	CGI abuses	high
126806	FreeBSD : jenkins -- multiple vulnerabilities (df3db21d-1a4d-4c78-acf7-4639e5a795e0)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2019-10354

medium

Tenable Plugins

high

high

high

high