According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Medium Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing     the use of system-scoped credentials otherwise reserved for the global configuration. This allows     attackers with Item/Configure permission to access and capture credentials they are not entitled to. Jira     Plugin 3.12 defines the appropriate context for credentials lookup. (CVE-2023-49653)

  - Medium Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier does not correctly perform     permission checks in multiple HTTP endpoints. This allows attackers with global Item/Configure permission     (while lacking Item/Configure permission on any particular job) to do the following: Enumerate system-     scoped credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture     the credentials using another vulnerability. Connect to Google Cloud Platform using attacker-specified     credentials IDs obtained through another method, to obtain information about existing projects. Google     Compute Engine Plugin 4.551.v5a_4dc98f6962 requires Overall/Administer permission for the affected HTTP     endpoints. (CVE-2023-49652)

  - High MATLAB Plugin determines whether a user-specified directory on the Jenkins controller is the location     of a MATLAB installation by parsing an XML file in that directory. MATLAB Plugin 2.11.0 and earlier does     not perform permission checks in several HTTP endpoints implementing related form validation.
    Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery     (CSRF) vulnerability. Additionally, the plugin does not configure its XML parser to prevent XML external     entity (XXE) attacks. This allows attackers able to create files on the Jenkins controller file system to     have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the     Jenkins controller or server-side request forgery. MATLAB Plugin 2.11.1 configures its XML parser to     prevent XML external entity (XXE) attacks. Additionally, POST requests and Item/Configure permission are     required for the affected HTTP endpoints. (CVE-2023-49654, CVE-2023-49655, CVE-2023-49656)

  - Medium NeuVector Vulnerability Scanner Plugin 1.22 and earlier does not perform a permission check in a     connection test HTTP endpoint. This allows attackers with Overall/Read permission to connect to an     attacker-specified hostname and port using attacker-specified username and password. Additionally, this     HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF)     vulnerability. NeuVector Vulnerability Scanner Plugin 2.2 requires POST requests and Overall/Administer     permission for the affected HTTP endpoint. (CVE-2023-49673, CVE-2023-49674)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Jenkins plugins Multiple Vulnerabilities (2023-11-29)

critical Nessus Plugin ID 186420

Version 1.1

Version 1.0

Version 1.0

Version 1.1 Dec 6, 2023, 3:36 PM CVSS metrics ("CVSSv2 score" set to 10.0. "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H". "CVSSv3 score" set to 9.8. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 score source (changed from "CVE-2023-49656" to "CVE-2023-49673") CVSSv3 score source (set to "CVE-2023-49656") Plugin Feed: 202312061536
Version 1.0 Nov 29, 2023, 5:31 PM New Plugin Feed: 202311291731
Version 1.0 Dec 6, 2023, 1:33 PM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 9.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2023-49656" to "CVE-2023-49673") CVSSv3 score source (set to "CVE-2023-49656") CVSS metrics ("CVSSv2 score" set to 10.0) Plugin Feed: 202312061333