Multiple Jenkins Plugins Multiple Security Vulnerabilities
BID:107476
CVE-2019-1003029 | CVE-2019-1003030 | CVE-2019-1003031 | CVE-2019-1003032 | CVE-2019-1003033 | CVE-2019-1003034 | CVE-2019-1003035 | CVE-2019-1003036 | CVE-2019-1003037 | CVE-2019-1003038 | CVE-2019-1003039 |Info
Multiple Jenkins Plugins Multiple Security Vulnerabilities
| Bugtraq ID: | 107476 |
| Class: | Unknown |
| CVE: |
CVE-2019-1003029 CVE-2019-1003030 CVE-2019-1003031 CVE-2019-1003032 CVE-2019-1003033 CVE-2019-1003034 CVE-2019-1003035 CVE-2019-1003036 CVE-2019-1003037 CVE-2019-1003038 CVE-2019-1003039 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 06 2019 12:00AM |
| Updated: | Mar 06 2019 12:00AM |
| Credit: | Daniel Beck, CloudBees, Inc., Georgy Noseevich (@webpentest), SolidLab, Oleg Nenashev, CloudBees, Inc., Viktor Gazdag |
| Vulnerable: |
Jenkins Script Security 1.9 Jenkins Script Security 1.8 Jenkins Script Security 1.7 Jenkins Script Security 1.6 Jenkins Script Security 1.53 Jenkins Script Security 1.52 Jenkins Script Security 1.51 Jenkins Script Security 1.50 Jenkins Script Security 1.5 Jenkins Script Security 1.49 Jenkins Script Security 1.48 Jenkins Script Security 1.47 Jenkins Script Security 1.46 Jenkins Script Security 1.45 Jenkins Script Security 1.44 Jenkins Script Security 1.43 Jenkins Script Security 1.42 Jenkins Script Security 1.41 Jenkins Script Security 1.40 Jenkins Script Security 1.4 Jenkins Script Security 1.39 Jenkins Script Security 1.38 Jenkins Script Security 1.31 Jenkins Script Security 1.30 Jenkins Script Security 1.3 Jenkins Script Security 1.29 Jenkins Script Security 1.28 Jenkins Script Security 1.27 Jenkins Script Security 1.26 Jenkins Script Security 1.25 Jenkins Script Security 1.24 Jenkins Script Security 1.23 Jenkins Script Security 1.22 Jenkins Script Security 1.21 Jenkins Script Security 1.20 Jenkins Script Security 1.2 Jenkins Script Security 1.19 Jenkins Script Security 1.18 Jenkins Script Security 1.17 Jenkins Script Security 1.16 Jenkins Script Security 1.15 Jenkins Script Security 1.14 Jenkins Script Security 1.13 Jenkins Script Security 1.12 Jenkins Script Security 1.11 Jenkins Script Security 1.10 Jenkins Script Security 1.1 Jenkins Script Security 1.0 Jenkins Repository Connector 1.2.4 Jenkins Rabbit-MQ Publisher 1.0 Jenkins Pipeline: Groovy 2.61.1 Jenkins Pipeline: Groovy 2.63 Jenkins Pipeline: Groovy 2.62 Jenkins Pipeline: Groovy 2.61 Jenkins Pipeline: Groovy 2.60 Jenkins Pipeline: Groovy 2.59 Jenkins Pipeline: Groovy 2.58 Jenkins Pipeline: Groovy 2.57 Jenkins Pipeline: Groovy 2.56 Jenkins Pipeline: Groovy 2.55 Jenkins Pipeline: Groovy 2.54 Jenkins Pipeline: Groovy 2.53 Jenkins Pipeline: Groovy 2.52 Jenkins Pipeline: Groovy 2.51 Jenkins Pipeline: Groovy 2.50 Jenkins Pipeline: Groovy 2.49 Jenkins Pipeline: Groovy 2.48 Jenkins Pipeline: Groovy 2.47 Jenkins Pipeline: Groovy 2.46 Jenkins Pipeline: Groovy 2.45 Jenkins Pipeline: Groovy 2.44 Jenkins Pipeline: Groovy 2.43 Jenkins Pipeline: Groovy 2.42 Jenkins OSF Builder Suite For Salesforce Commerce Cloud :: Deploy 1.0.10 Jenkins Matrix Project 1.7.1 Jenkins Matrix Project 1.4.1 Jenkins Matrix Project 1.9 Jenkins Matrix Project 1.8 Jenkins Matrix Project 1.7 Jenkins Matrix Project 1.6 Jenkins Matrix Project 1.5 Jenkins Matrix Project 1.4 Jenkins Matrix Project 1.3 Jenkins Matrix Project 1.2 Jenkins Matrix Project 1.13 Jenkins Matrix Project 1.12 Jenkins Matrix Project 1.11 Jenkins Matrix Project 1.10 Jenkins Matrix Project 1.1 Jenkins Matrix Project 1.0 Beta 1 Jenkins Matrix Project 1.0 Jenkins Job DSL 1.71 Jenkins Groovy 2.1 Jenkins Email Extension 2.64 Jenkins Bitbar Run-in-Cloud 2.69.1 Jenkins Azure VM Agents 0.8 Jenkins Azure VM Agents 0.7.5 Jenkins Azure VM Agents 0.7.4 Jenkins Azure VM Agents 0.7.3 Jenkins Azure VM Agents 0.7.2 Jenkins Azure VM Agents 0.7.1 Jenkins Azure VM Agents 0.7 Jenkins Azure VM Agents 0.6.2 Jenkins Azure VM Agents 0.6.1 Jenkins Azure VM Agents 0.5 Jenkins Azure VM Agents 0.4.8 Jenkins Azure VM Agents 0.4.7 Jenkins Azure VM Agents 0.4.6 Jenkins Azure VM Agents 0.4.5 Beta Jenkins Azure VM Agents 0.4.4 Beta Jenkins Azure VM Agents 0.4.3 Beta Jenkins Azure VM Agents 0.4.2 Beta Jenkins Azure VM Agents 0.4.1 Beta Jenkins Azure VM Agents 0.4 beta Jenkins Azure VM Agents 0.4.7.1 Jenkins AppDynamics Dashboard 1.0.14 Jenkins AppDynamics Dashboard 1.0.13 Jenkins AppDynamics Dashboard 1.0.2 Jenkins AppDynamics Dashboard 1.0.1 Jenkins AppDynamics Dashboard 1.0 Jenkins AppDynamics Dashboard 1.0.3-12 |
| Not Vulnerable: |
Jenkins Script Security 1.54 Jenkins Repository Connector 1.2.5 Jenkins Rabbit-MQ Publisher 1.2 Jenkins Pipeline: Groovy 2.64 Jenkins OSF Builder Suite For Salesforce Commerce Cloud :: Deploy 1.0.11 Jenkins Matrix Project 1.14 Jenkins Job DSL 1.72 Jenkins Groovy 2.2 Jenkins Email Extension 2.65 Jenkins Bitbar Run-in-Cloud 2.70 Jenkins Azure VM Agents 0.9 Jenkins Azure VM Agents 0.8.1 Jenkins AppDynamics Dashboard 1.0.15 |
Discussion
Multiple Jenkins Plugins Multiple Security Vulnerabilities
Jenkins is prone to the following vulnerabilities:
1. Multiple security-bypass vulnerabilities
2. An unauthorized-access vulnerability
3. Multiple information disclosure vulnerabilities
An attacker may leverage these issues to bypass security restrictions, obtain potentially-sensitive information, perform certain unauthorized actions and gain access to the affected application.
The following Jenkins plugins are vulnerable:
AppDynamics Dashboard Plugin version 1.0.14 and prior are vulnerable.
Azure VM Agents Plugin version 0.8.0 and prior are vulnerable.
Bitbar Run-in-Cloud Plugin version 2.69.1 and prior are vulnerable.
Email Extension Plugin version 2.64 and prior are vulnerable.
Groovy Plugin version 2.1 and prior are vulnerable.
Job DSL Plugin version 1.71 and prior are vulnerable.
Matrix Project Plugin version 1.13 and prior are vulnerable.
OSF Builder Suite For Salesforce Commerce Cloud :: Deploy Plugin version 1.0.10 and prior are vulnerable.
Pipeline: Groovy Plugin version 2.63 and prior are vulnerable.
Rabbit-MQ Publisher Plugin version 1.0 and prior are vulnerable.
Repository Connector Plugin version 1.2.4 and prior are vulnerable.
Script Security Plugin version 1.53 and prior are vulnerable.
Jenkins is prone to the following vulnerabilities:
1. Multiple security-bypass vulnerabilities
2. An unauthorized-access vulnerability
3. Multiple information disclosure vulnerabilities
An attacker may leverage these issues to bypass security restrictions, obtain potentially-sensitive information, perform certain unauthorized actions and gain access to the affected application.
The following Jenkins plugins are vulnerable:
AppDynamics Dashboard Plugin version 1.0.14 and prior are vulnerable.
Azure VM Agents Plugin version 0.8.0 and prior are vulnerable.
Bitbar Run-in-Cloud Plugin version 2.69.1 and prior are vulnerable.
Email Extension Plugin version 2.64 and prior are vulnerable.
Groovy Plugin version 2.1 and prior are vulnerable.
Job DSL Plugin version 1.71 and prior are vulnerable.
Matrix Project Plugin version 1.13 and prior are vulnerable.
OSF Builder Suite For Salesforce Commerce Cloud :: Deploy Plugin version 1.0.10 and prior are vulnerable.
Pipeline: Groovy Plugin version 2.63 and prior are vulnerable.
Rabbit-MQ Publisher Plugin version 1.0 and prior are vulnerable.
Repository Connector Plugin version 1.2.4 and prior are vulnerable.
Script Security Plugin version 1.53 and prior are vulnerable.
Exploit / POC
Multiple Jenkins Plugins Multiple Security Vulnerabilities
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Multiple Jenkins Plugins Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Multiple Jenkins Plugins Multiple Security Vulnerabilities
References:
References:
- AppDynamics Dashboard (Jenkins)
- Azure VM Agents (Jenkins)
- Bitbar Run-in-Cloud (Jenkins)
- Email Extension (Jenkins)
- Groovy Plugin (Jenkins)
- Jenkins Home Page (Jenkins)
- Job DSL (Jenkins)
- Matrix Project (Jenkins)
- OSF Builder Suite For Salesforce Commerce Cloud :: Deploy (Jenkins)
- Pipeline: Groovy Plugin Page (Jenkins)
- Rabbit-MQ Publisher (Jenkins)
- Repository Connector (Jenkins)
- Script Security Plugin Homepage (Jenkins)
- Jenkins Security Advisory 2019-03-06 (Jenkins)