Detections
Analytics

Jenkins plugins Multiple Vulnerabilities (2022-03-15)

high Nessus Plugin ID 158977

Language:

Synopsis

An application running on a remote web server host is affected by multiple vulnerabilities

Description

According to its their self-reported version number, the version of Jenkins plugins running on the remote web server are Jenkins CloudBees AWS Credentials Plugin prior to 191., Dashboard View Plugin prior to 2.18.1, Environment Dashboard Plugin 1.1.10 or earlier, Extended Choice Parameter Plugin 346. or earlier, Favorite Plugin prior to 2.4.1, Folder-based Authorization Strategy Plugin prior to 1.4, GitLab Authentication Plugin 1.13 or earlier, Kubernetes Continuous Deploy Plugin 2.3.1 or earlier, List Git Branches Parameter Plugin 0.0.9 or earlier, Parameterized Trigger Plugin prior to 2.43.1, Release Helper Plugin 1.3.3 or earlier, Semantic Versioning Plugin prior to 1.14, Vmware vRealize CodeStream Plugin 1.2 or earlier, dbCharts Plugin 0.5.2 or earlier, global-build-stats Plugin 1.5 or earlier, incapptic connect uploader Plugin 1.15 or earlier. They are, therefore, affected by multiple vulnerabilities:

 - Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system. (CVE-2022-27195)

 - Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions. (CVE-2022-27196)

 - Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views. (CVE-2022-27197)

 - A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token. (CVE-2022-27198)

 - A missing permission check in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token. (CVE-2022-27199)

 - Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission. (CVE-2022-27200)

 - Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. (CVE-2022-27201)

 - Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
 (CVE-2022-27202)

 - Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller. (CVE-2022-27203)

 - A cross-site request forgery vulnerability in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers to connect to an attacker-specified URL. (CVE-2022-27204)

 - A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL. (CVE-2022-27205)

 - Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. (CVE-2022-27206)

 - Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission. (CVE-2022-27207)

 - Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller. (CVE-2022-27208)

 - A missing permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
 (CVE-2022-27209)

 - A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. (CVE-2022-27210)

 - A missing/An incorrect permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. (CVE-2022-27211)

 - Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. (CVE-2022-27212)

 - Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission. (CVE-2022-27213)

 - A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
 (CVE-2022-27214)

 - A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
 (CVE-2022-27215)

 - Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system. (CVE-2022-27216)

 - Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. (CVE-2022-27217)

 - Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. (CVE-2022-27218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade Semantic Versioning Plugin to version 1.14 or later, Parameterized Trigger Plugin to version 2.43.1 or later, Folder-based Authorization Strategy Plugin to version 1.4 or later, Favorite Plugin to version 2.4.1 or later, Dashboard View Plugin to version 2.18.1 or later, CloudBees AWS Credentials Plugin to version 191. or later

See Also

https://jenkins.io/security/advisory/2022-03-15

Plugin Details

Severity: High

ID: 158977

File Name: jenkins_security_advisory_2022-03-15_plugins.nasl

Version: 1.7

Type: combined

Agent: windows, macosx, unix

Family: CGI abuses

Published: 3/16/2022

Updated: 7/28/2023

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2022-27204

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cloudbees:jenkins, cpe:/a:jenkins:jenkins

Required KB Items: installed_sw/Jenkins

Exploit Ease: No known exploits are available

Patch Publication Date: 3/15/2022

Vulnerability Publication Date: 3/15/2022

Reference Information

CVE: CVE-2022-27195, CVE-2022-27196, CVE-2022-27197, CVE-2022-27198, CVE-2022-27199, CVE-2022-27200, CVE-2022-27201, CVE-2022-27202, CVE-2022-27203, CVE-2022-27204, CVE-2022-27205, CVE-2022-27206, CVE-2022-27207, CVE-2022-27208, CVE-2022-27209, CVE-2022-27210, CVE-2022-27211, CVE-2022-27212, CVE-2022-27213, CVE-2022-27214, CVE-2022-27215, CVE-2022-27216, CVE-2022-27217, CVE-2022-27218