Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library
    overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with
    Item/Configure permission on a folder to configure a folder-scoped library override that runs without
    sandbox protection. (CVE-2024-52554)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and     1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation,     allowing attackers with Overall/Read permission to check for the existence of files on the controller file     system. (CVE-2024-52549)

  - Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not     check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with     Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.
    (CVE-2024-52550)

  - Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main     (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with     Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved.
    (CVE-2024-52551)

  - Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with     JavaScript on the Authorization view, resulting in a stored cross-site scripting (XSS) vulnerability     exploitable by attackers with Item/Configure permission. (CVE-2024-52552)

  - Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the     previous session on login. (CVE-2024-52553)

  - Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection)     vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior     to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or     Apache Maven POMs - it will allow downloading external document type definitions and expand any entity     references contained therein when used. This can be used to exfiltrate data, access resources only the     machine running Ivy has access to or disturb the execution of Ivy in different ways. Starting with Ivy     2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow     DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing     Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more     lenient via newly introduced system properties where needed. Users of Ivy prior to version 2.5.2 can use     Java system properties to restrict processing of external DTDs, see the section about JAXP Properties for     External Access restrictions inside Oracle's Java API for XML Processing (JAXP) Security Guide.
    (CVE-2022-46751)

  - Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library     overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with     Item/Configure permission on a folder to configure a folder-scoped library override that runs without     sandbox protection. (CVE-2024-52554)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
411925	SCA: security update for io.jenkins.plugins:shared-library-version-override (GHSA-7845-crfj-phc4)	Tenable Cloud Security	SCA Checks	Local	high
411925	SCA: security update for io.jenkins.plugins:shared-library-version-override (GHSA-7845-crfj-phc4)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
210929	Jenkins plugins Multiple Vulnerabilities (2024-11-13)	Nessus	CGI abuses	Combined	high

Detections

Analytics

CVE-2024-52554

high

Tenable Plugins

high

high

high