Jenkins
Jenkins Security Advisory 2023-01-24
2023-01-24 Jan 24, 2023 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2023-01-24/. 25 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2023-01-24/
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
33 lines
Showing 1–33 of 33
Acknowledgement
BR2023-0000-010054
SECURITY-2973
unclaimed
SECURITY-2973
Credited as Daniel Beck, CloudBees, Inc.
CVE-2023-24422
BR2023-0000-010055
SECURITY-3016
unclaimed
Sandbox bypass vulnerability in Script Security Plugin
Credited as Devin Nusbaum, CloudBees, Inc.
CVE-2023-24452
BR2023-0000-010056
SECURITY-2800
unclaimed
CSRF vulnerability and missing permission check in TestQuality Updater Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-24451
BR2023-0000-010057
SECURITY-2803
unclaimed
Missing permission checks in Cisco Spark Notifier Plugin allow enumerating credentials IDs
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-24424
BR2023-0000-010058
SECURITY-2978
unclaimed
Session fixation vulnerability in OpenId Connect Authentication Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-24426
BR2023-0000-010059
SECURITY-2980
unclaimed
Session fixation vulnerability in Microsoft Entra ID (previously Azure AD) Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-24428
BR2023-0000-010060
SECURITY-2981
unclaimed
CSRF vulnerability in Bitbucket OAuth Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-24427
BR2023-0000-010061
SECURITY-2982
unclaimed
Session fixation vulnerability in Bitbucket OAuth Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-24449
BR2023-0000-010062
SECURITY-2985
unclaimed
Path traversal vulnerability in PWauth Security Realm Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-24457
BR2023-0000-010063
SECURITY-2986
unclaimed
CSRF vulnerability in Keycloak Authentication Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-24457
BR2023-0000-010064
SECURITY-2986
unclaimed
CSRF vulnerability in Keycloak Authentication Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2023-24456
BR2023-0000-010065
SECURITY-2987
unclaimed
Session fixation vulnerability in Keycloak Authentication Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-24456
BR2023-0000-010066
SECURITY-2987
unclaimed
Session fixation vulnerability in Keycloak Authentication Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2023-24446
BR2023-0000-010067
SECURITY-2995
unclaimed
CSRF vulnerability in OpenID Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-24446
BR2023-0000-010068
SECURITY-2995
unclaimed
CSRF vulnerability in OpenID Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2023-24444
BR2023-0000-010069
SECURITY-2996
unclaimed
Session fixation vulnerability in OpenID Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-24444
BR2023-0000-010070
SECURITY-2996
unclaimed
Session fixation vulnerability in OpenID Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2023-24445
BR2023-0000-010071
SECURITY-2997
unclaimed
Open redirect vulnerability in OpenID Plugin
Credited as Kevin Guerroudj, CloudBees, Inc.
CVE-2023-24445
BR2023-0000-010072
SECURITY-2997
unclaimed
Open redirect vulnerability in OpenID Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.
CVE-2023-24454
BR2023-0000-010073
SECURITY-2091
unclaimed
Password stored in plain text by TestQuality Updater Plugin
Credited as Long Nguyen, Viettel Cyber Security
CVE-2023-24441
BR2023-0000-010074
SECURITY-2292
unclaimed
XXE vulnerability on agents in MSTest Plugin
Credited as Marc Heyries, Justin Philip, Kevin Guerroudj
CVE-2023-24441
BR2023-0000-010075
SECURITY-2292
unclaimed
XXE vulnerability on agents in MSTest Plugin
Credited as CC Bomber, Kitri BoB
CVE-2023-24425
BR2023-0000-010076
SECURITY-3022
unclaimed
Exposure of system-scoped Kubernetes credentials in Kubernetes Credentials Provider Plugin
Credited as Marcelo Castro, intersoft AG
CVE-2023-24455
BR2023-0000-010077
SECURITY-2709
unclaimed
Path traversal vulnerability in visualexpert Plugin
Credited as Valdes Che Zogou, CloudBees, Inc.
CVE-2023-24443
BR2023-0000-010078
SECURITY-2741
unclaimed
XXE vulnerability in TestComplete support Plugin
Credited as Valdes Che Zogou, CloudBees, Inc.
CVE-2023-24458
BR2023-0000-010079
SECURITY-2745
unclaimed
CSRF vulnerability and missing permission check in BearyChat Plugin
Credited as Valdes Che Zogou, CloudBees, Inc.
CVE-2023-24442
BR2023-0000-010080
SECURITY-2767
unclaimed
Credentials stored in plain text by GitHub Pull Request Coverage Status Plugin
Credited as Valdes Che Zogou, CloudBees, Inc.
Acknowledgement
BR2023-0000-010081
SECURITY-2772
unclaimed
SECURITY-2772
Credited as Valdes Che Zogou, CloudBees, Inc.
CVE-2023-24439
BR2023-0000-010082
SECURITY-2774
unclaimed
Keys stored in plain text by JIRA Pipeline Steps Plugin
Credited as Valdes Che Zogou, CloudBees, Inc.
CVE-2023-24437
BR2023-0000-010083
SECURITY-2786
unclaimed
CSRF vulnerability and missing permission checks in JIRA Pipeline Steps Plugin
Credited as Valdes Che Zogou, CloudBees, Inc.
CVE-2023-24450
BR2023-0000-010084
SECURITY-2787
unclaimed
Passwords stored in plain text by view-cloner Plugin
Credited as Valdes Che Zogou, CloudBees, Inc.
CVE-2023-24423
BR2023-0000-010085
SECURITY-2137
unclaimed
CSRF vulnerability in Gerrit Trigger Plugin
Credited as Wadeck Follonier, CloudBees, Inc.
CVE-2023-24447
BR2023-0000-010086
SECURITY-2778
unclaimed
CSRF vulnerability and missing permission check in RabbitMQ Consumer Plugin
Credited as Yaroslav Afenkin, CloudBees, Inc.