Stored XSS vulnerability in Active Choices Plugin
SECURITY-2219 / CVE-2021-21699
Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Active Choices Plugin 2.5.7 escapes references to parameter names.
Stored XSS vulnerability in Scriptler Plugin
SECURITY-2406 / CVE-2021-21700
Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Scriptler scripts.
Scriptler Plugin 3.4 escapes the name of scripts on the UI when asking to confirm their deletion.
XXE vulnerability in Performance Plugin
SECURITY-2394 / CVE-2021-21701
Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control workspace contents to have Jenkins parse a crafted XML report file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
As of publication of this advisory, there is no fix.
XXE vulnerability in pom2config Plugin
SECURITY-2415 / CVE-2021-43576
pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
As of publication of this advisory, there is no fix.
XXE vulnerability in OWASP Dependency-Check Plugin
SECURITY-2488 / CVE-2021-43577
OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control workspace contents to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
As of publication of this advisory, there is no fix.
Arbitrary file write vulnerability in Squash TM Publisher (Squash4Jenkins) Plugin
SECURITY-2525 / CVE-2021-43578
Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input.
This allows attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JSON string.
As of publication of this advisory, there is no fix.
Credit
The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:
Adith Sudhakar working with Trend Micro Zero Day Initiative for SECURITY-2394, SECURITY-2415
Daniel Beck, CloudBees, Inc. for SECURITY-2525
Guy Lederfein of Trend Micro for SECURITY-2406
Kevin Guerroudj, and, independently, Audrey Prieur of Trend Micro for SECURITY-2219