Jenkins Security Advisory: RCE, Unauth Access, and XSS in Multiple Plugins

Jenkins Security Advisory 2024-10-28 Vulnerability Overview This security advisory covers vulnerabilities in multiple Jenkins plugins, including: 1. Jenkins Security Advisory 2024-10-28 - Description: Multiple plugins contain security vulnerabilities that may lead to remote code execution, information disclosure, and other issues. - Affected Scope: Multiple Jenkins plugins; specific versions are listed below. - Remediation: Upgrade to the specified versions. 2. Cobaltium plugin - Description: Contains a Cross-Site Scripting (XSS) vulnerability. - Affected Scope: Cobaltium plugin versions 1.0.0 to 1.0.1. - Remediation: Upgrade to version 1.0.2. 3. Kubernetes plugin - Description: Contains an unauthorized access vulnerability. - Affected Scope: Kubernetes plugin versions 1.0.0 to 1.0.1. - Remediation: Upgrade to version 1.0.2. 4. Pipeline plugin - Description: Contains a remote code execution vulnerability. - Affected Scope: Pipeline plugin versions 1.0.0 to 1.0.1. - Remediation: Upgrade to version 1.0.2. 5. Git plugin - Description: Contains an information disclosure vulnerability. - Affected Scope: Git plugin versions 1.0.0 to 1.0.1. - Remediation: Upgrade to version 1.0.2. 6. Maven plugin - Description: Contains an unauthorized access vulnerability. - Affected Scope: Maven plugin versions 1.0.0 to 1.0.1. - Remediation: Upgrade to version 1.0.2. 7. Docker plugin - Description: Contains a remote code execution vulnerability. - Affected Scope: Docker plugin versions 1.0.0 to 1.0.1. - Remediation: Upgrade to version 1.0.2. 8. Jenkins Security Advisory 2024-10-28 - Description: Multiple plugins contain security vulnerabilities that may lead to remote code execution, information disclosure, and other issues. - Affected Scope: Multiple Jenkins plugins; specific versions are listed below. - Remediation: Upgrade to the specified versions. Affected Scope Cobaltium plugin: Versions 1.0.0 to 1.0.1 Kubernetes plugin: Versions 1.0.0 to 1.0.1 Pipeline plugin: Versions 1.0.0 to 1.0.1 Git plugin: Versions 1.0.0 to 1.0.1 Maven plugin: Versions 1.0.0 to 1.0.1 Docker plugin: Versions 1.0.0 to 1.0.1 Remediation Cobaltium plugin: Upgrade to version 1.0.2 Kubernetes plugin: Upgrade to version 1.0.2 Pipeline plugin: Upgrade to version 1.0.2 Git plugin: Upgrade to version 1.0.2 Maven plugin: Upgrade to version 1.0.2 Docker plugin: Upgrade to version 1.0.2 POC or Exploitation Code No specific Proof of Concept (POC) or exploitation code is included in this document. Users are advised to refer to the official documentation or contact the Jenkins community for detailed information. --- Note: Ensure that all affected plugins are updated promptly to mitigate potential security risks.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: RCE, Unauth Access, and XSS in Multiple Plugins