The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.222.x prior to 2.222.43.0.3 rev2, 2.249.x prior to 2.249.30.0.3 rev2, or 2.x prior to 2.277.1.2 rev2. It is, therefore, affected by multiple vulnerabilities, including the following:

  - An incorrect permission check in Jenkins Matrix Authorization Strategy Plugin 2.6.5 and earlier allows     attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission     for parent folders. (CVE-2021-21623)

  - An incorrect permission check in Jenkins Role-based Authorization Strategy Plugin 3.1 and earlier allows     attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission     for parent folders. (CVE-2021-21624)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins Libvirt Agents Plugin 1.9.0 and earlier     allows attackers to stop hypervisor domains. (CVE-2021-21627)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Jenkins Enterprise and Operations Center < 2.222.43.0.3 rev2 / 2.249.30.0.3 rev2 / 2.277.1.2 rev2 Multiple Vulnerabilities (CloudBees Security Advisory 2021-03-18)

high Nessus Plugin ID 155633

Version 1.4