Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
251 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Since Jenkins 2.340, symbol-based icons unescape previously escaped values of tooltip parameters. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability. Symbol-based icons no longer unescape values of tooltip parameters.
Recommended action: Upgrade to 2.356 or 2.332.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Since Jenkins 2.320 and LTS 2.332.1, help icon tooltips no longer escape the feature name, effectively undoing the fix for SECURITY-1955. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the feature name in help icon tooltips is now escaped.
Recommended action: Upgrade to 2.356, 2.346.1 or 2.332.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm. This allows attackers to determine the validity of attacker-specified usernames. Login attempts with an invalid username now validate a synthetic password to eliminate the timing discrepancy in Jenkins 2.356, LTS 2.332.4.
Recommended action: Upgrade to 2.356 or 2.332.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.
Recommended action: Upgrade to 2.197 or 2.176.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability exploitable by users able to control parts of the reason a queue item is blocked, such as label expressions not matching any idle executors.
Recommended action: Upgrade to 2.197 or 2.176.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
Recommended action: Upgrade to 2.197 or 2.176.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Configure).
Recommended action: Upgrade to 2.197 or 2.176.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
Recommended action: Upgrade to 2.197 or 2.176.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents.
Recommended action: Upgrade to 2.197 or 2.176.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. SECURITY-2486 / CVE-2021-21690: Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path. We expect that most of these vulnerabilities have been present since SECURITY-144 was addressed in the 2014-10-30 security advisory. Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities. SECURITY-2486 / CVE-2021-21690: Agent processes are no longer able to completely bypass file path filtering by wrapping the file operation in an agent file path. As some common operations are now newly subject to access control, it is…
Recommended action: Upgrade to 2.319 or 2.303.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. SECURITY-2531 / CVE-2021-21691: Creating symbolic links is possible without the symlink permission. We expect that most of these vulnerabilities have been present since SECURITY-144 was addressed in the 2014-10-30 security advisory. Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities. SECURITY-2531 / CVE-2021-21691: Creating symbolic links now correctly checks the symlink permission. As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly…
Recommended action: Upgrade to 2.319 or 2.303.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. SECURITY-2539 / CVE-2021-21693: When creating temporary files, permission to create files is only checked after they’ve been created. We expect that most of these vulnerabilities have been present since SECURITY-144 was addressed in the 2014-10-30 security advisory. Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities. SECURITY-2539 / CVE-2021-21693: When creating temporary files, permission to create files is checked before they are created based on an artificial path. As some common operations are now newly subject to access control, it is expected that plugins…
Recommended action: Upgrade to 2.319 or 2.303.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. SECURITY-2538 / CVE-2021-21692: The operations FilePath#renameTo and FilePath#moveAllChildrenTo only check read permission on the source path. We expect that most of these vulnerabilities have been present since SECURITY-144 was addressed in the 2014-10-30 security advisory. Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities. SECURITY-2538 / CVE-2021-21692: The operations FilePath#renameTo and FilePath#moveAllChildrenTo check both read and delete permissions on the source path. As some common operations are now newly subject to access control, it is expected that…
Recommended action: Upgrade to 2.319 or 2.303.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. SECURITY-2485 / CVE-2021-21689: FilePath#unzip and FilePath#untar were not subject to any access control. We expect that most of these vulnerabilities have been present since SECURITY-144 was addressed in the 2014-10-30 security advisory. Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities. SECURITY-2485 / CVE-2021-21689: FilePath#unzip and FilePath#untar are now subject to access control. As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the…
Recommended action: Upgrade to 2.319 or 2.303.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. SECURITY-2484 / CVE-2021-21688: FilePath#reading(FileVisitor) does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, #copyRecursiveTo). We expect that most of these vulnerabilities have been present since SECURITY-144 was addressed in the 2014-10-30 security advisory. Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities. SECURITY-2484 / CVE-2021-21688: FilePath#reading(FileVisitor) correctly rejects operations if they operate on files outside allowed directories. As some common operations are now…
Recommended action: Upgrade to 2.319 or 2.303.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. SECURITY-2446 / CVE-2021-21687: FilePath#untar does not check permission to create symbolic links when unarchiving a symbolic link. We expect that most of these vulnerabilities have been present since SECURITY-144 was addressed in the 2014-10-30 security advisory. Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities. SECURITY-2446 / CVE-2021-21687: FilePath#untar checks permission to create symbolic links when unarchiving a symbolic link. As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the…
Recommended action: Upgrade to 2.319 or 2.303.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. SECURITY-2541 / CVE-2021-21694: FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#getDiskSpace do not check any permissions. We expect that most of these vulnerabilities have been present since SECURITY-144 was addressed in the 2014-10-30 security advisory. Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities. SECURITY-2541 / CVE-2021-21694: FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant check stat permission. FilePath#getDiskSpace methods are no longer allowed to be executed by an agent. As…
Recommended action: Upgrade to 2.319 or 2.303.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems. SECURITY-2542 / CVE-2021-21695: FilePath#listFiles lists files outside directories with agent read access when following symbolic links. We expect that most of these vulnerabilities have been present since SECURITY-144 was addressed in the 2014-10-30 security advisory. Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities. SECURITY-2542 / CVE-2021-21695: FilePath#listFiles checks stat permission on files it returns, preventing listing files outside allowed directories. As some common operations are now newly subject to access control, it is expected that plugins sending…
Recommended action: Upgrade to 2.319 or 2.303.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Agents are allowed some limited access to files on the Jenkins controller file system. The directories agents are allowed to access in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier include the directories storing build-related information, intended to allow agents to store build-related metadata during build execution. As a consequence, this allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions (build.xml and some Pipeline-related metadata). Jenkins 2.319, LTS 2.303.3 prevents agents from accessing contents of build directories unless it’s for builds currently running on the agent attempting to access the directory. Update Pipeline: Nodes and Processes to version 2.40 or newer for Jenkins to associate Pipeline node blocks with the agent they’re running on for this fix. If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the Remoting Security Workaround Plugin. It will prevent all…
Recommended action: Upgrade to 2.319 or 2.303.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs. This directory is used by the Pipeline: Shared Groovy Libraries Plugin to store copies of shared libraries. This allows attackers in control of agent processes to replace the code of a trusted library with a modified variant, resulting in unsandboxed code execution in the Jenkins controller process. Jenkins 2.319, LTS 2.303.3 prohibits agent read/write access to the libs/ directory inside build directories. If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the Remoting Security Workaround Plugin. It will prevent all agent-to-controller file access using FilePath APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it. It is not easily possible to customize the file…
Recommended action: Upgrade to 2.319 or 2.303.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The file browser for workspaces, archived artifacts, and userContent/ in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows. This results in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files.\n\nThe file browser in Jenkins 2.315, LTS 2.303.2 refuses to serve files that would be considered absolute paths.
Recommended action: Upgrade to 2.315 or 2.303.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins stores jobs and other entities on disk using their name shown on the UI as file and folder names. On Windows, when specifying a file or folder with a trailing dot character (example.), the file or folder will be treated as if that character was not present (example). As both are legal names for jobs and other entities in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier, this could allow users with the appropriate permissions to change or replace configurations of jobs and other entities. Jenkins 2.315, LTS 2.303.2 does not allow names of jobs and other entities to end with a dot character.
Recommended action: Upgrade to 2.315 or 2.303.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. This vulnerability was introduced in Jenkins 2.266 and LTS 2.277.1. Jenkins 2.300, LTS 2.289.2 invalidates the previous session on login. In case of problems, administrators can choose a different implementation by setting the Java system property hudson.security.SecurityRealm.sessionFixationProtectionMode to 2, or disable the fix entirely by setting that system property to 0.
Recommended action: Upgrade to 2.300 or 2.289.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission. Jenkins 2.300, LTS 2.289.2 requires that users have Item/Read permission for applicable types in addition to Item/Cancel permission. As a workaround on earlier versions of Jenkins, do not grant Item/Cancel permission to users who do not have Item/Read permission.
Recommended action: Upgrade to 2.300 or 2.289.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the config.xml REST API endpoint of a node. This allows attackers with Computer/Configure permission to replace a node with one of a different type. Jenkins 2.287, LTS 2.277.2 validates the type of object created and rejects objects of unexpected types.
Recommended action: Upgrade to 2.287 or 2.277.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.