CloudBees Security Advisories

This form validation method requires appropriate permission in Fortify on Demand Plugin 6.0.0. STORED XSS VULNERABILITY IN VNCRECORDER PLUGIN SECURITY-1728 (1) / CVE-2020-2205 VncRecorder Plugin 1.25 and earlier does not escape a tool path in the checkVncS ...

CLOUDBEES SECURITY ADVISORY 2020-06-22 This advisory announces vulnerabilities in CloudBees Jenkins Platform and CloudBees Core. CSRF IN SHARED AGENT CONFIGURATION CTR-1645 We fixed a Cross-Site Request Forgery (CSRF) issue in Shared Agent configuration.

This results in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master (e.g. through archiving artifacts).

Masters now only support SSO requests from Hosts (or X-Forwarded-Host) matching the configured Jenkins Root URL. This issue is due to an incomplete fix of CTR-1098, announced in 2020-03-09 and wrongly called"CSRF in Authentication Mechanism in SSO".

IMPROPER MASKING OF SOME SECRETS IN CREDENTIALS BINDING PLUGIN SECURITY-1835 / CVE-2020-2182 Credentials Binding Plugin allows specifying passwords and other secrets as environment variables, and will hide them from console output in builds.

MISSING PERMISSION CHECK LEADS TO SSRF IN “VMWARE AUTOSCALING PLUGIN” CTR-1293 When using the Test Connection feature on the VMware Pools page, a missing permission check allowed a user without CONFIGURE permissions to call the validation endpoint, leading ...

JENKINS SECURITY ADVISORY 2020-04-16 This advisory announces vulnerabilities in Jenkins CREDENTIALS STORED IN PLAIN TEXT BY COPR PLUGIN SECURITY-1556 / CVE-2020-2177 Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files as part ...

This allows a user able to control the input files for the"Publish Coverage Report" post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins master or server-side request forgery.

This allows a user able to control the input files for the 'RapidDeploy deployment package build' build or post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins master, server-side reque ...

Script Security Plugin 1.71 has additional restrictions and sanity checks to ensure that super constructors cannot be constructed without being intercepted by the sandbox.

INFORMATION DISCLOSURE IN CLOUDBEES AMAZON AWS CLI PLUGIN CTR-1006 A user with permission to see a job could list the AWS credential IDs available for a job, without the expected permission.

This form validation method requires POST requests and Item/Configure permission in Pipeline GitHub Notify Step Plugin 1.0.5. USERS WITH OVERALL/READ ACCESS CAN ENUMERATE CREDENTIAL IDS IN PIPELINE GITHUB NOTIFY STEP PLUGIN SECURITY-812 (2) / CVE-2020-2118 ...