Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global
    configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins
    controller file system. (CVE-2021-21614)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose
    agent names that cause Jenkins to override the global `config.xml` file. (CVE-2021-21605)

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser
    for workspaces and archived artifacts by following symlinks. (CVE-2021-21602)

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents,
    resulting in a cross-site scripting (XSS) vulnerability. (CVE-2021-21603)

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure
    various objects to inject crafted content into Old Data Monitor that results in the instantiation of
    potentially unsafe objects once discarded by an administrator. (CVE-2021-21604)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.222.x prior to 2.222.43.0.1, 2.249.x prior to 2.249.30.0.1, or 2.x prior to 2.263.2.2. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure     various objects to inject crafted content into Old Data Monitor that results in the instantiation of     potentially unsafe objects once discarded by an administrator. (CVE-2021-21604)

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose     agent names that cause Jenkins to override the global `config.xml` file. (CVE-2021-21605)

  - Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of     always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they     did have Overall/Read permission. (CVE-2021-21609)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
412857	SCA: security update for org.jenkins-ci.plugins:bumblebee (GHSA-8v72-qr3h-c6rv)	Tenable Cloud Security	SCA Checks	medium
412857	SCA: security update for org.jenkins-ci.plugins:bumblebee (GHSA-8v72-qr3h-c6rv)	Tenable Self-Hosted Container Security	SCA Checks	medium
405040	Alpine: multiple jenkins packages: security update to 2.275-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405040	Alpine: multiple jenkins packages: security update to 2.275-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
155715	Jenkins Enterprise and Operations Center < 2.222.43.0.1 / 2.249.30.0.1 / 2.263.2.2 Multiple Vulnerabilities (CloudBees Security Advisory 2021-01-13)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2021-21614

medium

Tenable Plugins

medium

medium

high

high

high