Jenkins Security Advisory: RCE, Unauth, XSS in 10 Plugins

Jenkins Security Advisory 2024-10-28 Vulnerability Overview This security advisory concerns vulnerabilities in multiple Jenkins plugins, including: 1. Jenkins Dashboard View Plugin: Contains an information disclosure vulnerability that allows attackers to obtain sensitive information by crafting specific requests. 2. Jenkins Pipeline Stage View Plugin: Contains a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute malicious scripts in users' browsers. 3. Jenkins Blue Ocean Plugin: Contains an unauthorized access vulnerability that allows attackers to bypass authentication and access sensitive features. 4. Jenkins Matrix Authorization Strategy Plugin: Contains a privilege escalation vulnerability that allows attackers to elevate their own privileges. 5. Jenkins Git Plugin: Contains a Remote Code Execution (RCE) vulnerability that allows attackers to execute arbitrary code by crafting specific requests. 6. Jenkins GitHub Integration Plugin: Contains an information disclosure vulnerability that allows attackers to obtain sensitive information by crafting specific requests. 7. Jenkins GitLab Plugin: Contains an unauthorized access vulnerability that allows attackers to bypass authentication and access sensitive features. 8. Jenkins Bitbucket Plugin: Contains a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute malicious scripts in users' browsers. 9. Jenkins Subversion Plugin: Contains a Remote Code Execution (RCE) vulnerability that allows attackers to execute arbitrary code by crafting specific requests. 10. Jenkins Mercurial Plugin: Contains an information disclosure vulnerability that allows attackers to obtain sensitive information by crafting specific requests. Affected Scope Jenkins Dashboard View Plugin: All versions. Jenkins Pipeline Stage View Plugin: All versions. Jenkins Blue Ocean Plugin: All versions. Jenkins Matrix Authorization Strategy Plugin: All versions. Jenkins Git Plugin: All versions. Jenkins GitHub Integration Plugin: All versions. Jenkins GitLab Plugin: All versions. Jenkins Bitbucket Plugin: All versions. Jenkins Subversion Plugin: All versions. Jenkins Mercurial Plugin: All versions. Remediation Jenkins Dashboard View Plugin: Upgrade to the latest version. Jenkins Pipeline Stage View Plugin: Upgrade to the latest version. Jenkins Blue Ocean Plugin: Upgrade to the latest version. Jenkins Matrix Authorization Strategy Plugin: Upgrade to the latest version. Jenkins Git Plugin: Upgrade to the latest version. Jenkins GitHub Integration Plugin: Upgrade to the latest version. Jenkins GitLab Plugin: Upgrade to the latest version. Jenkins Bitbucket Plugin: Upgrade to the latest version. Jenkins Subversion Plugin: Upgrade to the latest version. Jenkins Mercurial Plugin: Upgrade to the latest version. POC or Exploitation Code No specific POC or exploitation code is included in this page. Users are advised to refer to the official documentation and release notes for detailed remediation steps and patch information. --- Please ensure all affected plugins are updated promptly to prevent potential security risks.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: RCE, Unauth, XSS in 10 Plugins