Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths,
    which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
    (CVE-2020-2160)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths,
    which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.
    (CVE-2020-2160)

  - Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in
    the form validation for label expressions on job configuration pages, resulting in a stored XSS
    vulnerability exploitable by users able to define node labels. (CVE-2020-2161)

  - Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files
    uploaded as file parameters to a build, resulting in a stored XSS vulnerability. (CVE-2020-2162)

  - Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column
    headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers.
    (CVE-2020-2163)

The version of Jenkins running on the remote web server is prior to 2.228 or is a version of Jenkins LTS prior to 2.204.6 or 2.222.1. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass vulnerability exists in Jenkins' CSRF prevention component. An unauthenticated, remote     attacker can exploit this, by sending specially crafted requests to a vulnerable Jenkins instance, to bypass     authentication and conduct a CSRF attack (CVE-2020-2160).

  - A stored cross-site scripting (XSS) vulnerability exists in Jenkins' label expression validation component due to     improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can     exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's     browser session (CVE-2020-2161).

  - A stored cross-site scripting (XSS) vulnerability exists in Jenkins' file parameter component due to improper     validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this,     by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser     session (CVE-2020-2162).

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version   number.

Jenkins Security Advisory : Description(High) SECURITY-1774 / CVE-2020-2160 CSRF protection for any URL could be bypassed (Medium) SECURITY-1781 / CVE-2020-2161 Stored XSS vulnerability in label expression validation (Medium) SECURITY-1793 / CVE-2020-2162 Stored XSS vulnerability in file parameters (Medium) SECURITY-1796 / CVE-2020-2163 Stored XSS vulnerability in list view column headers

ID	Name	Product	Family	Severity
413733	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-c735-g9f2-2mvp)	Tenable Cloud Security	SCA Checks	high
413733	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-c735-g9f2-2mvp)	Tenable Self-Hosted Container Security	SCA Checks	high
405038	Alpine: multiple jenkins packages: security update to 2.228-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405038	Alpine: multiple jenkins packages: security update to 2.228-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400391	Alpine: multiple jenkins packages: security update to 2.225-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400391	Alpine: multiple jenkins packages: security update to 2.225-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
135178	Jenkins < (2.204.6 / 2.222.1) LTS / 2.228 Multiple Vulnerabilities	Nessus	CGI abuses	high
134922	FreeBSD : jenkins -- multiple vulnerabilities (5bf6ed6d-9002-4f43-ad63-458f59e45384)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2020-2160

high

Tenable Plugins

high

high

high

high

high

high

high

high