According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an     input string of modest size can lead to indefinite amounts of memory being used. (CVE-2023-5072)

  - Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in     an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the     Jenkins controller file system. (CVE-2023-50764)

  - A missing permission check in Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier allows attackers     with Overall/Read permission to read the contents of a Groovy script by knowing its ID. (CVE-2023-50765)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier     allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML.
    (CVE-2023-50766)

  - Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with     Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as     XML. (CVE-2023-50767)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier     allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs     obtained through another method, capturing credentials stored in Jenkins. (CVE-2023-50768)

  - Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with     Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified     credentials IDs obtained through another method, capturing credentials stored in Jenkins. (CVE-2023-50769)

  - Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account     used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins     controller file system to recover the plain text password of that account, likely gaining administrator     access to Jenkins. (CVE-2023-50770)

  - Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL     after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.
    (CVE-2023-50771)

  - Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml     files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or     access to the Jenkins controller file system. (CVE-2023-50772)

  - Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job     configuration form, increasing the potential for attackers to observe and capture them. (CVE-2023-50773)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows     attackers to delete arbitrary files on the Jenkins controller file system. (CVE-2023-50774)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and     earlier allows attackers to copy jobs. (CVE-2023-50775)

  - Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in     job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read     permission or access to the Jenkins controller file system. (CVE-2023-50776)

  - Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed     on the job configuration form, increasing the potential for attackers to observe and capture them.
    (CVE-2023-50777)

  - A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier     allows attackers to connect to an attacker-specified URL using an attacker-specified token.
    (CVE-2023-50778)

  - Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with     Overall/Read permission to connect to an attacker-specified URL using an attacker-specified token.
    (CVE-2023-50779)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Jenkins plugins Multiple Vulnerabilities (2023-12-13)

high Nessus Plugin ID 186836

Version 1.1

Version 1.0

Version 1.1 Dec 19, 2023, 8:16 PM CVSS metrics ("CVSSv2 score" set to 10.0. "CVSSv3 score" set to 8.8. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C". "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2023-5072" to "CVE-2023-50778") Plugin Feed: 202312192016
Version 1.0 Dec 14, 2023, 4:32 PM New Plugin Feed: 202312141632