A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows
    attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials
    stored in Jenkins. (CVE-2023-35149)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx     server by default. (CVE-2023-35142)

  - Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on     the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS)     vulnerability exploitable by attackers able to control maven project versions in `pom.xml`.
    (CVE-2023-35143)

  - Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on     the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS)     vulnerability. (CVE-2023-35144)

  - Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not escape the file path and the project name     for the Log file field form validation, resulting in a stored cross-site scripting vulnerability     exploitable by attackers with Item/Configure permission. (CVE-2023-35145)

  - Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as     buildings blocks for Template Workflow Job, resulting in a stored cross-site scripting (XSS) vulnerability     exploitable by attackers able to create jobs. (CVE-2023-35146)

  - Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path     parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of     arbitrary files on the Jenkins controller file system. (CVE-2023-35147)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins Digital.ai App Management Publisher Plugin     2.6 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in     Jenkins. (CVE-2023-35148)

  - A missing permission check in Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier allows     attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials     stored in Jenkins. (CVE-2023-35149)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
446622	SCA: security update for org.jenkins-ci.plugins:ease-plugin (GHSA-5ghv-wxh9-7356)	Tenable Cloud Security	SCA Checks	Local	medium
446622	SCA: security update for org.jenkins-ci.plugins:ease-plugin (GHSA-5ghv-wxh9-7356)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
177394	Jenkins plugins Multiple Vulnerabilities (2023-06-14)	Nessus	CGI abuses	Combined	high

Detections

Analytics

CVE-2023-35149

medium

Tenable Plugins

medium

medium

high