Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-
    site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.
    (CVE-2021-21613)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose
    agent names that cause Jenkins to override the global `config.xml` file. (CVE-2021-21605)

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser
    for workspaces and archived artifacts by following symlinks. (CVE-2021-21602)

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents,
    resulting in a cross-site scripting (XSS) vulnerability. (CVE-2021-21603)

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure
    various objects to inject crafted content into Old Data Monitor that results in the instantiation of
    potentially unsafe objects once discarded by an administrator. (CVE-2021-21604)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.222.x prior to 2.222.43.0.1, 2.249.x prior to 2.249.30.0.1, or 2.x prior to 2.263.2.2. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure     various objects to inject crafted content into Old Data Monitor that results in the instantiation of     potentially unsafe objects once discarded by an administrator. (CVE-2021-21604)

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose     agent names that cause Jenkins to override the global `config.xml` file. (CVE-2021-21605)

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of     always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they     did have Overall/Read permission. (CVE-2021-21609)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
420586	SCA: security update for io.jenkins.plugins:tics (GHSA-xmw5-45v9-pxqx)	Tenable Cloud Security	SCA Checks	Local	medium
420586	SCA: security update for io.jenkins.plugins:tics (GHSA-xmw5-45v9-pxqx)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
405040	Alpine: multiple jenkins packages: security update to 2.275-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
405040	Alpine: multiple jenkins packages: security update to 2.275-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
155715	Jenkins Enterprise and Operations Center < 2.222.43.0.1 / 2.249.30.0.1 / 2.263.2.2 Multiple Vulnerabilities (CloudBees Security Advisory 2021-01-13)	Nessus	CGI abuses	Combined	high

Detections

Analytics

CVE-2021-21613

medium

Tenable Plugins

medium

medium

high

high

high