Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on
    the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability
    exploitable by attackers able to configure job names. (CVE-2022-38664)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.303.x prior to 2.303.30.0.16, or 2.x prior to 2.346.4.1. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
    (CVE-2021-25738)

  - Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in     the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.
    (CVE-2022-38663)

  - Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global     configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins     controller file system. (CVE-2022-38665)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in     the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.
    (CVE-2022-38663)

  - Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on     the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability     exploitable by attackers able to configure job names. (CVE-2022-38664)

  - Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global     configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins     controller file system. (CVE-2022-38665)

  - Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
    (CVE-2021-25738)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
408808	SCA: security update for org.jenkins-ci.plugins:jobConfigHistory (GHSA-28w4-h56g-grg7)	Tenable Cloud Security	SCA Checks	Local	medium
408808	SCA: security update for org.jenkins-ci.plugins:jobConfigHistory (GHSA-28w4-h56g-grg7)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
165693	Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.16 / 2.346.4.1 Multiple Vulnerabilities (CloudBees Security Advisory 2022-08-27)	Nessus	CGI abuses	Combined	medium
164452	Jenkins plugins Multiple Vulnerabilities (2022-08-23)	Nessus	CGI abuses	Combined	medium

Detections

Analytics

CVE-2022-38664

medium

Tenable Plugins

medium

medium

medium

medium