Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects
    that are shared with the configured owner group, allowing attackers to configure and share a project,
    resulting in a crafted Pipeline being built by Jenkins during the next scan of the group. (CVE-2024-23901)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command     parser that replaces an '@' character followed by a file path in an argument with the file's contents,     allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins     controller file system. (CVE-2024-23899)

  - Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of     multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any     config.xml files on the Jenkins controller file system with content not controllable by the attackers.
    (CVE-2024-23900)

  - Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects     that are shared with the configured owner group, allowing attackers to configure and share a project,     resulting in a crafted Pipeline being built by Jenkins during the next scan of the group. (CVE-2024-23901)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin     684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL. (CVE-2024-23902)

  - Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison     function when checking whether the provided and expected webhook token are equal, potentially allowing     attackers to use statistical methods to obtain a valid webhook token. (CVE-2024-23903)

  - Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be     affected by a security flaw, which was missing a permission check while performing a connectivity check to     Qualys Cloud Services. This allowed any user with login access and access to configure or edit jobs to     utilize the plugin to configure a potential rouge endpoint via which it was possible to control response     for certain request which could be injected with XSS payloads leading to XSS while processing the response     data (CVE-2023-6148)

  - Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be     affected by a security flaw, which was missing a permission check while performing a connectivity check to     Qualys Cloud Services. This allowed any user with login access to configure or edit jobs to utilize the     plugin and configure potential a rouge endpoint via which it was possible to control response for certain     request which could be injected with XXE payloads leading to XXE while processing the response data     (CVE-2023-6147)

  - Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-     Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers     for download. (CVE-2024-23905)

  - Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that     replaces an '@' character followed by a file path in an argument with the file's contents, allowing     unauthenticated attackers to read content from arbitrary files on the Jenkins controller file system.
    (CVE-2024-23904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
414729	SCA: security update for io.jenkins.plugins:gitlab-branch-source (GHSA-fw9h-cxx9-gfq3)	Tenable Cloud Security	SCA Checks	Local	medium
414729	SCA: security update for io.jenkins.plugins:gitlab-branch-source (GHSA-fw9h-cxx9-gfq3)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
189462	Jenkins plugins Multiple Vulnerabilities (2024-01-24)	Nessus	CGI abuses	Combined	high

Detections

Analytics

CVE-2024-23901

medium

Tenable Plugins

medium

medium

high