Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In Jenkins CloudBees CD Plugin, artifacts that were previously copied from an agent to the controller are deleted after publishing by the 'CloudBees CD - Publish Artifact' post-build step. CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during this cleanup process. This allows attackers able to configure jobs to delete arbitrary files on the Jenkins controller file system. CloudBees CD Plugin 1.1.33 deletes symbolic links without following them.
Recommended action: Upgrade to 1.1.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins CloudBees CD Plugin temporarily copies files from an agent workspace to the controller in preparation for publishing them in the 'CloudBees CD - Publish Artifact' post-build step. CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the temporary directory on the controller when collecting the list of files to publish. This allows attackers able to configure jobs to publish arbitrary files from the Jenkins controller file system to the previously configured CloudBees CD server. CloudBees CD Plugin 1.1.33 ensures that only files located within the expected directory are published.
Recommended action: Upgrade to 1.1.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Jenkins CloudBees CD Plugin does not perform a permission check in an HTTP endpoint. This allows attackers with Item/Read permission to schedule builds of projects without having Item/Build permission. Jenkins CloudBees CD Plugin requires Item/Build permission to schedule builds via its HTTP endpoint.
Recommended action: Upgrade to 1.1.22 or 1.1.18.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The plugin adds metadata displayed on build pages during its operations. Any user content was not escaped, resulting in a cross-site scripting vulnerability allowing users with Job/Configure permission, or attackers controlling API responses received from ElectricFlow to render arbitrary HTML and JavaScript on Jenkins build pages. Build metadata is now filtered through a HTML formatter that only allows showing basic HTML, neutralizing any unsafe data. Additionally, all builds executed after the security update is applied will now properly escape content received from ElectricFlow.
Recommended action: Upgrade to 1.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing permission check in a form validation method in CloudBees CD Plugin allowed users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified username and password. Additionally, the form validation method did not require POST requests, resulting in a CSRF vulnerability. This form validation method now requires POST requests and Overall/Administer permissions.
Recommended action: Upgrade to 1.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CloudBees CD Plugin unconditionally disabled SSL/TLS certificate validation for the entire Jenkins controller JVM during the deployment/publication of an application. CloudBees CD Plugin no longer does that. Instead, the existing opt-in option to ignore SSL/TLS errors is used during deployment for the specific connection. This issue was caused by an incomplete fix for SECURITY-937.
Recommended action: Upgrade to 1.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing permission check in a form validation method in CloudBees CD Plugin allowed users with Overall/Read permission to initiate a connection test to an attacker-specified server with attacker-specified username and password. Additionally, the form validation method did not require POST requests, resulting in a CSRF vulnerability. This form validation method now requires POST requests and Overall/Administer permissions.
Recommended action: Upgrade to 1.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The configuration forms of various post-build steps contributed by CloudBees CD Plugin were vulnerable to cross-site scripting. This allowed attackers able to control the output of connected ElectricFlow servers' APIs to inject arbitrary HTML and JavaScript into the configuration form. CloudBees CD Plugin no longer interprets HTML/JavaScript in responses from ElectricFlow server APIs on job configuration forms.
Recommended action: Upgrade to 1.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Various form validation and form autocompletion methods in CloudBees CD Plugin lacked permission checks. This allowed attackers with Overall/Read access to obtain information about the configuration of CloudBees CD Plugin, as well as the configuration and data of connected ElectricFlow servers. These form validation and autocompletion methods now require Overall/Administer or Job/Configure permission, as appropriate for the given method.
Recommended action: Upgrade to 1.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.