Detections
Analytics

Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.7 Multiple Vulnerabilities (CloudBees Security Advisory 2023-01-24)

critical Nessus Plugin ID 170555

Language:

Synopsis

A job scheduling and management system hosted on the remote web server is affected by multiple vulnerabilities.

Description

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.346.x prior to 2.346.40.0.7. It is, therefore, affected by multiple vulnerabilities including the following:

 - Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

 - CSRF vulnerability in Gerrit Trigger Plugin (CVE-2023-24423)

 - Session fixation vulnerability in OpenId Connect Authentication Plugin (CVE-2023-24424)

 - Exposure of system-scoped Kubernetes credentials in Kubernetes Credentials Provider Plugin (CVE-2023-24425)

 - Session fixation vulnerability in Azure AD Plugin (CVE-2023-24426)

 - Session fixation vulnerability in Bitbucket OAuth Plugin (CVE-2023-24427)

 - CSRF vulnerability in Bitbucket OAuth Plugin (CVE-2023-24428)

 - Agent-to-controller security bypass in Semantic Versioning Plugin (CVE-2023-24429)

 - XXE vulnerability on agents in Semantic Versioning Plugin (CVE-2023-24430)

 - Missing permission checks in Orka by MacStadium Plugin allow enumerating credentials IDs (CVE-2023-24431)

 - CSRF vulnerability and missing permission checks in Orka by MacStadium Plugin allow capturing credentials (CVE-2023-24432, CVE-2023-24433)

 - CSRF vulnerability and missing permission checks in GitHub Pull Request Builder Plugin (CVE-2023-24434, CVE-2023-24435)

 - Missing permission check in GitHub Pull Request Builder Plugin allows enumerating credentials IDs (CVE-2023-24436)

 - CSRF vulnerability and missing permission checks in JIRA Pipeline Steps Plugin (CVE-2023-24437, CVE-2023-24438)

 - Keys stored in plain text by JIRA Pipeline Steps Plugin (CVE-2023-24439, CVE-2023-24440)

 - XXE vulnerability on agents in MSTest Plugin (CVE-2023-24441)

 - Credentials stored in plain text by GitHub Pull Request Coverage Status Plugin (CVE-2023-24442)

 - XXE vulnerability in TestComplete support Plugin (CVE-2023-24443)

 - Session fixation vulnerability in OpenID Plugin (CVE-2023-24444)

 - Open redirect vulnerability in OpenID Plugin (CVE-2023-24445)

 - CSRF vulnerability in OpenID Plugin (CVE-2023-24446)

 - CSRF vulnerability and missing permission check in RabbitMQ Consumer Plugin (CVE-2023-24447, CVE-2023-24448)

 - Path traversal vulnerability in PWauth Security Realm Plugin (CVE-2023-24449)

 - Passwords stored in plain text by view-cloner Plugin (CVE-2023-24450)

 - Missing permission checks in Cisco Spark Notifier Plugin allow enumerating credentials IDs (CVE-2023-24451)

 - CSRF vulnerability and missing permission check in TestQuality Updater Plugin (CVE-2023-24452, CVE-2023-24453)

 - Password stored in plain text by TestQuality Updater Plugin (CVE-2023-24454)

 - Path traversal vulnerability in visualexpert Plugin (CVE-2023-24455)

 - Session fixation vulnerability in Keycloak Authentication Plugin (CVE-2023-24456)

 - CSRF vulnerability in Keycloak Authentication Plugin (CVE-2023-24457)

 - CSRF vulnerability and missing permission check in BearyChat Plugin (CVE-2023-24458, CVE-2023-24459)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade Jenkins Enterprise or Jenkins Operations Center to version 2.346.40.0.7 or later.

See Also

http://www.nessus.org/u?01c53c96

Plugin Details

Severity: Critical

ID: 170555

File Name: cloudbees-security-advisory-2023-01-24.nasl

Version: 1.1

Type: combined

Agent: windows, macosx, unix

Family: CGI abuses

Published: 1/24/2023

Updated: 2/3/2023

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-24458

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2023-24456

Vulnerability Information

CPE: cpe:/a:cloudbees:jenkins

Required KB Items: installed_sw/Jenkins

Exploit Ease: No known exploits are available

Patch Publication Date: 1/24/2023

Vulnerability Publication Date: 1/24/2023

Reference Information

CVE: CVE-2023-24422, CVE-2023-24423, CVE-2023-24424, CVE-2023-24425, CVE-2023-24426, CVE-2023-24427, CVE-2023-24428, CVE-2023-24429, CVE-2023-24430, CVE-2023-24431, CVE-2023-24432, CVE-2023-24433, CVE-2023-24434, CVE-2023-24435, CVE-2023-24436, CVE-2023-24437, CVE-2023-24438, CVE-2023-24439, CVE-2023-24440, CVE-2023-24441, CVE-2023-24442, CVE-2023-24443, CVE-2023-24444, CVE-2023-24445, CVE-2023-24446, CVE-2023-24447, CVE-2023-24448, CVE-2023-24449, CVE-2023-24450, CVE-2023-24451, CVE-2023-24452, CVE-2023-24453, CVE-2023-24454, CVE-2023-24455, CVE-2023-24456, CVE-2023-24457, CVE-2023-24458, CVE-2023-24459