Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header
    on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session
    cookie despite it being marked HttpOnly. (CVE-2019-10405)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in
    the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with
    Overall/Administer permission. (CVE-2019-10406)

  - In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted
    its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with
    permission to define its contents (typically Job/Configure). (CVE-2019-10401)

  - In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item
    labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its
    contents. (CVE-2019-10402)

  - Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM
    tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names
    for these actions. (CVE-2019-10403)

  - Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked
    in tooltips, resulting in a stored XSS vulnerability exploitable by users able to control parts of the
    reason a queue item is blocked, such as label expressions not matching any idle executors.
    (CVE-2019-10404)

The version of Jenkins running on the remote web server is prior to 2.197 or is a version of Jenkins LTS prior to 2.176.4. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability exists in the /whoAmI/ URL due to the exposed 'Cookie' HTTP     Header. An authenticated, remote attacker can exploit this, via a separate Cross-site scripting (XSS)     vulnerability, to disclose potentially sensitive information. (CVE-2019-10405)

  - A stored Cross-site scripting (XSS) vulnerability exists in the f:formbox form control due to the form     control interpreting its item labels as HTML. An authenticated, remote attacker with permission to control     the contents of f:formbox form controls can exploit this to execute arbitrary script code in a user's     browser session. (CVE-2019-10402)

  - A stored Cross-site scripting (XSS) vulnerability exists in the tooltip for SCM tag actions due to the     application not escaping characters in the SCM tag name. An authenticated, remote attacker with     permission to control SCM tag names can exploit this to execute arbitrary code in a user's browser     session.  (CVE-2019-10403)

The version of Jenkins running on the remote web server is also affected by other Cross-site scripting (XSS) vulnerabilities. (CVE-2019-10401, CVE-2019-10404, CVE-2019-10406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Jenkins Security Advisory : Description(Medium) SECURITY-1498 / CVE-2019-10401 Stored XSS vulnerability in expandable textbox form control (Medium) SECURITY-1525 / CVE-2019-10402 XSS vulnerability in combobox form control (Medium) SECURITY-1537 (1) / CVE-2019-10403 Stored XSS vulnerability in SCM tag action tooltip (Medium) SECURITY-1537 (2) / CVE-2019-10404 Stored XSS vulnerability in queue item tooltip (Medium) SECURITY-1505 / CVE-2019-10405 Diagnostic web page exposed Cookie HTTP header (Medium) SECURITY-1471 / CVE-2019-10406 XSS vulnerability in Jenkins URL setting

ID	Name	Product	Family	Severity
410030	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-47wc-p5cp-w7pw)	Tenable Cloud Security	SCA Checks	medium
410030	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-47wc-p5cp-w7pw)	Tenable Self-Hosted Container Security	SCA Checks	medium
405037	Alpine: multiple jenkins packages: security update to 2.199-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
405037	Alpine: multiple jenkins packages: security update to 2.199-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
130099	Jenkins < 2.176.4 LTS / 2.197 Multiple Vulnerabilities	Nessus	CGI abuses	medium
129369	FreeBSD : jenkins -- multiple vulnerabilities (9720bb39-f82a-402f-9fe4-e2c875bdda83)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-10405

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium