This advisory announces vulnerabilities in the following Jenkins deliverables:
script-security
Sandbox protection in Script Security Plugin could be circumvented through default parameter expressions in constructors.
This allowed attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins controller JVM.
These expressions are now subject to sandbox protection.
htmlpublisher
HTML Publisher Plugin did not escape the project or build display name shown in the frame HTML page. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the project or build display name, typically users with Job/Configure or Build/Update permission.
HTML Publisher Plugin now escapes the display name displayed in the frame HTML page.
dingding-notifications
DingTalk Plugin stores an access token unencrypted in job config.xml
files on the Jenkins controller.
This token can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
As of publication of this advisory, there is no fix.
ldapemail
LDAP Email Plugin stores an LDAP bind password in its global Jenkins configuration.
While the password is stored encrypted on disk, it is transmitted in plain text as part of the configuration form. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.
As of publication of this advisory, there is no fix.
vault-scm-plugin
SourceGear Vault Plugin stores an SCM password in job configurations.
While the password is stored encrypted on disk, it is transmitted in plain text as part of the configuration form. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.
As of publication of this advisory, there is no fix.
These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.
As of publication of this advisory, no fixes are available for the following plugins:
Learn why we announce these issues.
The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities: