关键漏洞信息 漏洞概述 公告日期: 2025-04-02 影响的Jenkins版本: - Jenkins (core) - AsakusaSatellite Plugin - Cadence vManager Plugin - monitor-remote-job Plugin - Simple Queue Plugin - Stack Hammer Plugin - Templating Engine Plugin 漏洞详情 1. Missing permission check allows retrieving agent configurations - CVE: CVE-2025-31720, CVE-2025-31721 - 严重性: 中等 - 描述: Jenkins 2.503及更早版本在HTTP端点上未执行权限检查，允许具有Agent/Create权限但无Agent/Extended Read权限的攻击者复制代理并访问其配置。 2. Script Security sandbox bypass vulnerability through folder-scoped libraries in Templating Engine Plugin - CVE: CVE-2025-31722 - 严重性: 高 - 描述: 在Templating Engine Plugin 2.5.3及更早版本中，文件夹中定义的库不受沙箱保护，导致具有Item/Configure权限的攻击者可以执行任意代码。 3. CSRF vulnerability in Simple Queue Plugin - CVE: CVE-2025-31723 - 严重性: 中等 - 描述: Simple Queue Plugin 1.4.6及更早版本在多个HTTP端点上不要求POST请求，导致跨站请求伪造（CSRF）漏洞。 4. API keys stored in plain text by Cadence vManager Plugin - CVE: CVE-2025-31724 - 严重性: 中等 - 描述: Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275及更早版本以明文形式存储Verisium Manager vAPI密钥。 5. Passwords stored in plain text by monitor-remote-job Plugin - CVE: CVE-2025-31725 - 严重性: 中等 - 描述: monitor-remote-job Plugin 1.0及更早版本以明文形式存储密码。 6. API keys stored in plain text by Stack Hammer Plugin - CVE: CVE-2025-31726 - 严重性: 中等 - 描述: Stack Hammer Plugin 1.0.0及更早版本以明文形式存储Stack Hammer API密钥。 7. API keys stored and displayed in plain text by AsakusaSatellite Plugin - CVE: CVE-2025-31727, CVE-2025-31728 - 严重性: 中等 - 描述: AsakusaSatellite Plugin 0.1.1及更早版本以明文形式存储AsakusaSatellite API密钥，并在作业配置表单中不遮掩这些API密钥。 影响版本 Jenkins weekly up to and including 2.503 Jenkins LTS up to and including 2.492.2 AsakusaSatellite Plugin up to and including 0.1.1 Cadence vManager Plugin up to and including 4.0.0-282.v5096a_c2db_275 monitor-remote-job Plugin up to and including 1.0 Simple Queue Plugin up to and including 1.4.6 Stack Hammer Plugin up to and including 1.0.0 Templating Engine Plugin up to and including 2.5.3 修复建议 更新至以下版本： - Jenkins weekly: 2.504 - Jenkins LTS: 2.492.3 - Cadence vManager Plugin: 4.0.1-286.v9e25a_740b_a_48 - Simple Queue Plugin: 1.4.7 - Templating Engine Plugin: 2.5.4