Jenkins Security Advisory: RCE, Container Escape, and Auth Bypass in 10 Plugins

Jenkins Security Advisory 2024-10-28 Vulnerability Overview This security advisory concerns vulnerabilities in multiple Jenkins plugins, including: 1. Jenkins Dashboard View Plugin: Contains an information disclosure vulnerability that allows attackers to obtain sensitive information by crafting specific requests. 2. Jenkins Pipeline Stage View Plugin: Contains a Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts. 3. Jenkins Blue Ocean Plugin: Contains an unauthorized access vulnerability that allows attackers to bypass authentication and access sensitive features. 4. Jenkins Matrix Authorization Strategy Plugin: Contains a privilege escalation vulnerability that allows attackers to elevate their privileges. 5. Jenkins Git Plugin: Contains a Remote Code Execution (RCE) vulnerability that allows attackers to execute arbitrary code. 6. Jenkins SSH Agent Plugin: Contains an information disclosure vulnerability that allows attackers to obtain sensitive information. 7. Jenkins Docker Pipeline Plugin: Contains a container escape vulnerability that allows attackers to escape from the container to the host machine. 8. Jenkins Kubernetes Plugin: Contains an unauthorized access vulnerability that allows attackers to bypass authentication and access sensitive features. 9. Jenkins CloudBees Jenkins Core Plugin: Contains a privilege escalation vulnerability that allows attackers to elevate their privileges. 10. Jenkins CloudBees Jenkins Enterprise Plugin: Contains an unauthorized access vulnerability that allows attackers to bypass authentication and access sensitive features. Impact Scope Jenkins Dashboard View Plugin: All versions. Jenkins Pipeline Stage View Plugin: All versions. Jenkins Blue Ocean Plugin: All versions. Jenkins Matrix Authorization Strategy Plugin: All versions. Jenkins Git Plugin: All versions. Jenkins SSH Agent Plugin: All versions. Jenkins Docker Pipeline Plugin: All versions. Jenkins Kubernetes Plugin: All versions. Jenkins CloudBees Jenkins Core Plugin: All versions. Jenkins CloudBees Jenkins Enterprise Plugin: All versions. Remediation Jenkins Dashboard View Plugin: Upgrade to the latest version. Jenkins Pipeline Stage View Plugin: Upgrade to the latest version. Jenkins Blue Ocean Plugin: Upgrade to the latest version. Jenkins Matrix Authorization Strategy Plugin: Upgrade to the latest version. Jenkins Git Plugin: Upgrade to the latest version. Jenkins SSH Agent Plugin: Upgrade to the latest version. Jenkins Docker Pipeline Plugin: Upgrade to the latest version. Jenkins Kubernetes Plugin: Upgrade to the latest version. Jenkins CloudBees Jenkins Core Plugin: Upgrade to the latest version. Jenkins CloudBees Jenkins Enterprise Plugin: Upgrade to the latest version. POC or Exploit Code No specific POC or exploit code is included in this page. Users are advised to refer to the official remediation guidelines and release notes to perform security updates.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: RCE, Container Escape, and Auth Bypass in 10 Plugins