Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of
    multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any
    config.xml files on the Jenkins controller file system with content not controllable by the attackers.
    (CVE-2024-23900)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4597 advisory.

    Jenkins is a continuous integration server that monitors the execution of recurring jobs, such as software     builds or cron jobs.

    Security Fix(es):

    * jenkins-plugin/script-security: Sandbox bypass via sandbox-defined classes (CVE-2024-34145)

    * jenkins-plugin/script-security: Sandbox bypass via crafted constructor bodies (CVE-2024-34144)

    * jenkins-2-plugins: Improper input sanitization in HTML Publisher Plugin (CVE-2024-28149)

    * jenkins-2-plugins: git-server plugin arbitrary file read vulnerability (CVE-2024-23899)

    * jetty: Stop accepting new connections from valid clients (CVE-2024-22201)

    * ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

    * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when     unmarshaling certain forms of invalid JSON (CVE-2024-24786)

    * jenkins-2-plugins: matrix-project plugin path traversal vulnerability (CVE-2024-23900)

    * runc: File descriptor leak (CVE-2024-21626, Leaky-Vessels)

    * jenkins-2-plugins: git-server plugin arbitrary file read vulnerability (CVE-2024-23899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3635 advisory.

    Jenkins is a continuous integration server that monitors the execution of recurring jobs, such as software     builds or cron jobs.

    Security fixes:

    * jenkins-2-plugins: Git-server plugin has an arbitrary file read vulnerability (CVE-2024-23899)

    * jenkins-plugin/script-security: Sandbox bypass occurs via crafted constructor bodies (CVE-2024-34144)

    * jenkins-plugin/script-security: Sandbox bypass occurs via sandbox-defined classes (CVE-2024-34145)

    * jenkins-2-plugins: HTML Publisher plugin has improper input sanitization (CVE-2024-28149)

    * Jetty: Stops accepting new connections from valid clients (CVE-2024-22201)

    * SSH: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

    * golang-protobuf: Unmarshaling certain forms of invalid JSON in the protojson.Unmarshal function causes     an infinite loop in the encoding/protojson and internal/encoding/json packages of Golang-protobuf     (CVE-2024-24786)

    * jenkins-2-plugins: Matrix-project plugin has a path traversal vulnerability (CVE-2024-23900)

    For more details about these security issues, including their impact, CVSS scores, acknowledgments, and     other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3636 advisory.

    Jenkins is a continuous integration server that monitors the execution of     recurring jobs, such as software builds or cron jobs.

    Security fixes:

    * jenkins-2-plugins: Git-server plugin has an arbitrary file read     vulnerability (CVE-2024-23899)

    * jenkins-plugin/script-security: Sandbox bypass occurs via crafted     constructor bodies (CVE-2024-34144)

    * jenkins-plugin/script-security: Sandbox bypass occurs via sandbox-defined     classes (CVE-2024-34145)

    * jenkins-2-plugins: HTML Publisher plugin has improper input sanitization     (CVE-2024-28149)

    * jetty: Stops accepting new connections from valid clients     (CVE-2024-22201)

    * SSH: Prefix truncation attack on Binary Packet Protocol (BPP)     (CVE-2023-48795)

    * golang-protobuf: Unmarshaling certain forms of invalid JSON in the     protojson.Unmarshal function causes an infinite loop in the     encoding/protojson and internal/encoding/json packages of Golang-protobuf     (CVE-2024-24786).

    * jenkins-2-plugins: Matrix-project plugin has a path traversal     vulnerability (CVE-2024-23900)

    For more details about these security issues, including their impact, CVSS     scores, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3634 advisory.

    Jenkins is a continuous integration server that monitors the execution of     recurring jobs, such as software builds or cron jobs.

    Security fixes:

    * jenkins-2-plugins: Git-server plugin has an arbitrary file read     vulnerability (CVE-2024-23899)

    * jenkins-plugin/script-security: Sandbox bypass occurs via crafted     constructor bodies (CVE-2024-34144)

    * jenkins-plugin/script-security: Sandbox bypass occurs via sandbox-defined     classes (CVE-2024-34145)

    * jenkins-2-plugins: HTML Publisher plugin has improper input sanitization     (CVE-2024-28149)

    * jetty: Stops accepting new connections from valid clients     (CVE-2024-22201)

    * SSH: Prefix truncation attack on Binary Packet Protocol (BPP)     (CVE-2023-48795)

    * golang-protobuf: Unmarshaling certain forms of invalid JSON in the     protojson.Unmarshal function causes an infinite loop in the     encoding/protojson and internal/encoding/json packages of Golang-protobuf     (CVE-2024-24786)

    * jenkins-2-plugins: Matrix-project plugin has a path traversal     vulnerability (CVE-2024-23900)

    For more details about these security issues, including their impact, CVSS     scores, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command     parser that replaces an '@' character followed by a file path in an argument with the file's contents,     allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins     controller file system. (CVE-2024-23899)

  - Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of     multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any     config.xml files on the Jenkins controller file system with content not controllable by the attackers.
    (CVE-2024-23900)

  - Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects     that are shared with the configured owner group, allowing attackers to configure and share a project,     resulting in a crafted Pipeline being built by Jenkins during the next scan of the group. (CVE-2024-23901)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin     684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL. (CVE-2024-23902)

  - Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison     function when checking whether the provided and expected webhook token are equal, potentially allowing     attackers to use statistical methods to obtain a valid webhook token. (CVE-2024-23903)

  - Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be     affected by a security flaw, which was missing a permission check while performing a connectivity check to     Qualys Cloud Services. This allowed any user with login access and access to configure or edit jobs to     utilize the plugin to configure a potential rouge endpoint via which it was possible to control response     for certain request which could be injected with XSS payloads leading to XSS while processing the response     data (CVE-2023-6148)

  - Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be     affected by a security flaw, which was missing a permission check while performing a connectivity check to     Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the     plugin and configure potential a rouge endpoint via which it was possible to control response for certain     request which could be injected with XXE payloads leading to XXE while processing the response data     (CVE-2023-6147)

  - Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-     Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers     for download. (CVE-2024-23905)

  - Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that     replaces an '@' character followed by a file path in an argument with the file's contents, allowing     unauthenticated attackers to read content from arbitrary files on the Jenkins controller file system.
    (CVE-2024-23904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
413946	SCA: security update for org.jenkins-ci.plugins:matrix-project (GHSA-cjgm-9vc9-56mx)	Tenable Cloud Security	SCA Checks	medium
413946	SCA: security update for org.jenkins-ci.plugins:matrix-project (GHSA-cjgm-9vc9-56mx)	Tenable Self-Hosted Container Security	SCA Checks	medium
202767	RHEL 8 : Red Hat Product OCP Tools 4.15 OpenShift Jenkins (RHSA-2024:4597)	Nessus	Red Hat Local Security Checks	critical
200120	RHEL 8 : Red Hat Product OCP Tools 4.12 Openshift Jenkins (RHSA-2024:3635)	Nessus	Red Hat Local Security Checks	critical
200118	RHEL 8 : Red Hat Product OCP Tools 4.13 OpenShift Jenkins (RHSA-2024:3636)	Nessus	Red Hat Local Security Checks	critical
200117	RHEL 8 : Red Hat Product OCP Tools 4.14 OpenShift Jenkins (RHSA-2024:3634)	Nessus	Red Hat Local Security Checks	critical
189462	Jenkins plugins Multiple Vulnerabilities (2024-01-24)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2024-23900

medium

Tenable Plugins

medium

medium

critical

critical

critical

critical

high