Detections
Analytics

Jenkins Accessible without Credentials

high Nessus Plugin ID 71215

Language:

Synopsis

The remote web server hosts a job scheduling / management system that is accessible without authentication.

Description

The remote web server hosts Jenkins, a job scheduling / management system and a drop-in replacement for Hudson. By allowing unauthenticated access to the application, anyone may be able to configure Jenkins and jobs, and perform builds.

Additionally, this script checks for unauthenticated access to '/scripts' as anyone with access to the script console can run arbitrary Groovy scripts on the remote host.

Solution

Refer to the Jenkins security guide for information on restricting access to Jenkins.

See Also

https://wiki.jenkins.io/display/JENKINS/Securing+Jenkins

Plugin Details

Severity: High

ID: 71215

File Name: jenkins_accessible.nasl

Version: 1.6

Type: remote

Family: CGI abuses

Published: 12/4/2013

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:cloudbees:jenkins

Required KB Items: www/Jenkins