Multiple Jenkins Plugins Multiple Security Vulnerabilities

Bugtraq ID:	107295
Class:	Input Validation Error
CVE:	CVE-2019-1003024 CVE-2019-1003025 CVE-2019-1003026 CVE-2019-1003027 CVE-2019-1003028
Remote:	Yes
Local:	No
Published:	Feb 19 2019 12:00AM
Updated:	Feb 19 2019 12:00AM
Credit:	Daniel Beck, CloudBees, Thomas de Grenier de Latour, Viktor Gazdag
Vulnerable:	Jenkins Script Security 1.9 Jenkins Script Security 1.8 Jenkins Script Security 1.7 Jenkins Script Security 1.6 Jenkins Script Security 1.52 Jenkins Script Security 1.51 Jenkins Script Security 1.50 Jenkins Script Security 1.5 Jenkins Script Security 1.49 Jenkins Script Security 1.48 Jenkins Script Security 1.47 Jenkins Script Security 1.46 Jenkins Script Security 1.45 Jenkins Script Security 1.44 Jenkins Script Security 1.43 Jenkins Script Security 1.42 Jenkins Script Security 1.41 Jenkins Script Security 1.40 Jenkins Script Security 1.4 Jenkins Script Security 1.39 Jenkins Script Security 1.38 Jenkins Script Security 1.31 Jenkins Script Security 1.30 Jenkins Script Security 1.3 Jenkins Script Security 1.29 Jenkins Script Security 1.28 Jenkins Script Security 1.27 Jenkins Script Security 1.26 Jenkins Script Security 1.25 Jenkins Script Security 1.24 Jenkins Script Security 1.23 Jenkins Script Security 1.22 Jenkins Script Security 1.21 Jenkins Script Security 1.20 Jenkins Script Security 1.2 Jenkins Script Security 1.19 Jenkins Script Security 1.18 Jenkins Script Security 1.17 Jenkins Script Security 1.16 Jenkins Script Security 1.15 Jenkins Script Security 1.14 Jenkins Script Security 1.13 Jenkins Script Security 1.12 Jenkins Script Security 1.11 Jenkins Script Security 1.10 Jenkins Script Security 1.1 Jenkins Script Security 1.0 Jenkins OctopusDeploy 1.8.1 Jenkins OctopusDeploy 1.3.0 Jenkins Mattermost Notification 2.6.2 Jenkins JMS Messaging 1.1.1 Jenkins JMS Messaging 1.0.0 Jenkins ElectricFlow 1.1.4 Jenkins ElectricFlow 1.0 Jenkins Cloud Foundry 2.3.1 Jenkins Cloud Foundry 2.0 Jenkins Cloud Foundry 1.0.3 Jenkins Arxan MAM Publisher 1.2.12 Jenkins Acunetix 1.0.0
Not Vulnerable:	Jenkins Script Security 1.53 Jenkins OctopusDeploy 1.9.0 Jenkins Mattermost Notification 2.6.3 Jenkins JMS Messaging 1.1.2 Jenkins ElectricFlow 1.1.5 Jenkins Cloud Foundry 2.3.2 Jenkins Arxan MAM Publisher 2.0 Jenkins Acunetix 1.1.0

Multiple Jenkins Plugins Multiple Security Vulnerabilities

Jenkins is prone to the following vulnerabilities:

1. Multiple security-bypass vulnerabilities
3. A cross-site request forgery vulnerability
4. Multiple information disclosure vulnerabilities

An attacker may leverage these issues to bypass security restrictions, obtain potentially-sensitive information, perform certain unauthorized actions and gain access to the affected application.

The following Jenkins plugins are vulnerable:

Acunetix Plugin 1.0.0 and prior
Arxan MAM Publisher Plugin 1.2.12 and prior
Cloud Foundry Plugin 2.3.1 and prior
ElectricFlow Plugin 1.1.4 and prior
JMS Messaging Plugin 1.1.1 and prior
Mattermost Notification Plugin 2.6.2 and prior
OctopusDeploy Plugin 1.8.1 and prior
Script Security Plugin 1.52 and prior

Multiple Jenkins Plugins Multiple Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Jenkins Plugins Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Jenkins Plugins Multiple Security Vulnerabilities

References:

• Jenkins Home Page (Jenkins)
  
• Jenkins Product Page (Jenkins)
  
• Jenkins Security Advisory 2019-02-19 (Jenkins)