A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows attackers to to promote builds.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows
    attackers to to promote builds. (CVE-2021-21641)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.222.x prior to 2.222.43.0.4, 2.249.x prior to 2.249.30.0.4, or 2.x prior to 2.277.2.3. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The     vulnerability affects all version 6.7 and earlier versions. (CVE-2021-22510)

  - Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins     plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow     unconditionally disabling of SSL/TLS certificates. (CVE-2021-22511)

  - Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin -     Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow     form validation without permission checks. (CVE-2021-22512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.277.2 or Jenkins weekly prior to 2.287. It is, therefore, affected by multiple vulnerabilities:

  - Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after     loading the data submitted to the `config.xml` REST API endpoint of a node, allowing attackers with     Computer/Configure permission to replace a node with one of a different type. (CVE-2021-21639)

  - Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has     an allowed name, allowing attackers with View/Create permission to create views with invalid or already-     used names. (CVE-2021-21640)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins promoted builds Plugin 3.9 and earlier allows     attackers to to promote builds. (CVE-2021-21641)     
  - Improper Certificate Validation vulnerability in Micro Focus Application Automation Tools Plugin -     Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could     allow unconditionally disabling of SSL/TLS certificates. (CVE-2021-22511)     
  - Cross-Site Request Forgery (CSRF) vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins     plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form     validation without permission checks. (CVE-2021-22512)     
  - Missing Authorization vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin.     The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow access without     permission checks. (CVE-2021-22513)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
410779	SCA: security update for org.jenkins-ci.plugins:promoted-builds (GHSA-5cxw-8v65-76vf)	Tenable Cloud Security	SCA Checks	medium
410779	SCA: security update for org.jenkins-ci.plugins:promoted-builds (GHSA-5cxw-8v65-76vf)	Tenable Self-Hosted Container Security	SCA Checks	medium
155586	Jenkins Enterprise and Operations Center < 2.222.43.0.4 / 2.249.30.0.4 / 2.277.2.3 Multiple Vulnerabilities (CloudBees Security Advisory 2021-04-07)	Nessus	CGI abuses	medium
148418	Jenkins LTS < 2.277.2 / Jenkins weekly < 2.287 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2021-21641

medium

Tenable Plugins

medium

medium

medium

medium