Jenkins Releases Patches for High-Severity Vulnerabilities in Multiple Plugins

August 21, 2023

Jenkins Releases Patches for High-Severity Vulnerabilities in Multiple Plugins

Jenkins, the popular open-source automation server, has recently announced the availability of patches to address high- and medium-severity vulnerabilities impacting several plugins. These patches are crucial for maintaining the security and integrity of Jenkins installations. Among the vulnerabilities, three high-severity cross-site request forgery (CSRF) and cross-site scripting (XSS) issues have been identified in the Folders, Flaky Test Handler, and Shortcut Job plugins.

High-severity vulnerabilities and patches

The Folders plugin, specifically versions 6.846.v23698686f0f6 and earlier, contains a high-severity vulnerability. This flaw stems from the fact that no POST requests were required for an HTTP endpoint, leading to CSRF attacks. Jenkins has addressed this issue in the latest patch.

The Flaky Test Handler plugin, versions 1.2.2 and earlier, suffers from a high-severity XSS vulnerability. The plugin fails to escape JUnit test contents when displayed in the Jenkins UI, thereby enabling attackers to execute XSS attacks. The recent patch ensures proper sanitization and mitigation of this vulnerability.

Versions 0.4 and earlier of the Shortcut Job plugin exhibit an XSS (cross-site scripting) flaw. This arises from the plugin’s failure to adequately escape the shortcut redirection URL. The vulnerability allows attackers to inject malicious code into the Jenkins UI, posing a significant security risk. The latest patch rectifies this flaw.

Furthermore, an additional high-severity XSS vulnerability has surfaced in the Docker Swarm plugin. Versions 1.11 and earlier of this plugin do not adequately sanitize values returned from Docker before they are inserted into the Docker Swarm Dashboard view. This vulnerability has been promptly addressed by Jenkins’ latest patch.

Medium-severity vulnerabilities and patches

Jenkins has also identified and addressed medium-severity vulnerabilities in various plugins, including:

1. Folders Plugin:
Apart from the high-severity vulnerability mentioned earlier, this plugin is susceptible to information disclosure, CSRF attacks, and HTML injection. Jenkins has provided patches to effectively mitigate these risks.

2. Config File Provider Plugin:
The Config File Provider plugin has vulnerabilities that may lead to credential leaks and CSRF attacks. Jenkins has released patches to address these issues, ensuring user credentials remain secure.

3. Node.js Plugin:
The Node.js plugin, if left unpatched, could result in information disclosure and CSRF attacks. The latest update resolves these vulnerabilities, safeguarding sensitive data.

4. Blue Ocean Plugin:
Another plugin affected by CSRF attacks and potential credential ID enumeration is Blue Ocean. Jenkins’ latest patches address these medium-severity vulnerabilities.

5. Fortify Plugin:
The Fortify plugin possesses vulnerabilities that could result in information disclosure and CSRF attacks. The patches offered by Jenkins effectively address these risks.

6. Delphix Plugin:
Similar to the other plugins mentioned, the Delphix plugin has medium-severity vulnerabilities that could lead to information disclosure and CSRF attacks. Jenkins’ patches ensure the plugin’s functionality remains secure.

Medium-severity vulnerabilities without patches

However, Jenkins warns that three medium-severity vulnerabilities in specific plugins have yet to receive patches. These plugins include the Maven Artifact ChoiceListProvider (Nexus), Gogs, and Favorite View plugins. These vulnerabilities may potentially expose credentials, disclose sensitive information, or facilitate CSRF attacks. Users are advised to remain vigilant and consider appropriate mitigating measures until patches become available.

Low-severity vulnerabilities and patches

Lastly, Jenkins has also addressed a low-severity vulnerability in the Tuleap Authentication plugin. The vulnerability allowed attackers to obtain a valid authentication token. This security flaw has been fixed in the latest patch, ensuring the plugin’s functionality remains secure.

Jenkins has demonstrated its commitment to proactively addressing vulnerabilities by releasing patches for high- and medium-severity security flaws in multiple plugins. However, users are urged to stay vigilant and apply the necessary patches promptly to ensure the utmost security of their Jenkins installations. Additionally, awareness of the three medium-severity vulnerabilities without patches is vital, and users should take extra precautions to mitigate potential risks. By staying proactive in addressing security concerns, the Jenkins community can continue to rely on a secure and robust automation server.

Explore more

How Did Zoom Use AI to Boost Customer Satisfaction to 80%?

March 5, 2026

When the world shifted to a screen-first existence, a simple video call became the lifeline of global commerce, education, and human connection, yet the massive surge in users nearly broke the engines of support that kept it running. While most tech giants watched their customer satisfaction scores plummet under the weight of unprecedented demand, Zoom executed a rare maneuver, lifting

How is Customer Experience Evolving in 2026?

March 5, 2026

Today, Customer Experience (CX) functions as the definitive business capability that dictates market perception, revenue sustainability, and long-term loyalty. Organizations are no longer evaluated solely on what they sell, but on how they make the customer feel throughout the entire lifecycle of their relationship. This fundamental shift has moved CX from the periphery of customer support to the very core

How HR Teams Can Combat Rising Recruitment Fraud

March 5, 2026

Modern job seekers are navigating a digital minefield where sophisticated imposters use the prestige of established brands to execute complex financial and identity theft schemes. As hiring surges become more frequent, these deceptive actors exploit the enthusiasm of candidates by offering flexible work and accelerated timelines that seem too good to be true. This phenomenon does not merely threaten individuals;

Trend Analysis: Skills-Based Hiring in Canada

March 5, 2026

The long-standing reliance on university degrees as a universal proxy for competence is rapidly losing its grip on the Canadian corporate landscape as organizations prioritize what people can actually do over where they studied. This shift signals the definitive end of the degree era, a period where formal credentials served as a convenient but often flawed filter for talent acquisition.

Is the Four-Year Degree Still the Key to Career Success?

March 5, 2026

The modern professional landscape is undergoing a profound transformation as the traditional four-year degree loses its status as the ultimate gatekeeper for white-collar employment. For the better part of a century, the degree functioned as a convenient screening mechanism for recruiters, signaling that a candidate possessed the discipline, baseline intelligence, and social capital necessary to succeed in a corporate environment.