Jenkins Multiple Plugin Vulnerability Advisory: RCE, LFI, and XSS

Vulnerability Overview Jenkins has released a security advisory covering multiple security vulnerabilities in several plugins. The primary vulnerabilities include: 1. RCE Vulnerability due to Unvalidated LDAP Redirection in the LDAP Plugin 2. RCE Vulnerability due to Unvalidated LDAP Redirection in the Active Directory Plugin 3. Arbitrary File Read Vulnerability in the Email Extension Plugin 4. Arbitrary File Read Vulnerability via Symbolic Links in the Pipeline: Groovy Libraries Plugin 5. Path Traversal Vulnerability in the Credentials Binding Plugin 6. Request Sending Vulnerability due to Missing Access Control Checks in the AppSpider Plugin 7. Open Redirect Vulnerability in the Bitbucket OAuth Plugin 8. CSRF Vulnerability in the GitHub Integration Plugin 9. CSRF Vulnerability in the Multijob Plugin 10. Credential ID Enumeration Vulnerability due to Missing Access Control Checks in the Job Import Plugin 11. Stored XSS Vulnerability in the buildgraph-view Plugin Affected Scope LDAP Plugin: Version 807.v7d7de30930cf and earlier Active Directory Plugin: Version 2.41 and earlier Email Extension Plugin: Version 1933.v45cec755423f and earlier Pipeline: Groovy Libraries Plugin: Version 797.v90ea_a_9b_e45a_0 and earlier Credentials Binding Plugin: Version 720.v3f6decef43ea_ and earlier AppSpider Plugin: Version 1.0.17 and earlier Bitbucket OAuth Plugin: Version 0.17 and earlier GitHub Integration Plugin: Version 0.7.3 and earlier Multijob Plugin: Version 662.vd2e0001fb_b_d and earlier Job Import Plugin: Version 143.v044a_2e819b_27 and earlier buildgraph-view Plugin: Version 1.8 and earlier Remediation LDAP Plugin: Upgrade to version 807.809.vd3a_4e5e4ec98 or later Active Directory Plugin: Upgrade to version 2.41.1 or later Email Extension Plugin: Upgrade to version 1933.1935.v276319e3cc47 or later Pipeline: Groovy Libraries Plugin: Upgrade to version 798.v5cc688825312 or later Credentials Binding Plugin: Upgrade to version 725.ve52b_2328a_fde or later AppSpider Plugin: Upgrade to version 1.0.18 or later Bitbucket OAuth Plugin: Upgrade to version 0.18 or later GitHub Integration Plugin: Upgrade to version 0.7.4 or later Multijob Plugin: Upgrade to version 669.v9d96a_9c71b_0 or later Job Import Plugin: Upgrade to version 143.145.v48f9a_a_6ff384 or later buildgraph-view Plugin: No fix available at this time POC Code or Exploit Code No specific POC code or exploit code was provided in the source material. Summary Jenkins has issued multiple security advisories concerning vulnerabilities in several plugins. Users are advised to upgrade to the specified versions as soon as possible to remediate these issues. For plugins with no fix available, users should monitor for subsequent updates.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Multiple Plugin Vulnerability Advisory: RCE, LFI, and XSS