Jenkins Releases Patches for High-Severity Vulnerabilities in Multiple Plugins

Jenkins, the popular open-source automation server, has recently announced the availability of patches to address high- and medium-severity vulnerabilities impacting several plugins. These patches are crucial for maintaining the security and integrity of Jenkins installations. Among the vulnerabilities, three high-severity cross-site request forgery (CSRF) and cross-site scripting (XSS) issues have been identified in the Folders, Flaky Test Handler, and Shortcut Job plugins.

High-severity vulnerabilities and patches

The Folders plugin, specifically versions 6.846.v23698686f0f6 and earlier, contains a high-severity vulnerability. This flaw stems from the fact that no POST requests were required for an HTTP endpoint, leading to CSRF attacks. Jenkins has addressed this issue in the latest patch.

The Flaky Test Handler plugin, versions 1.2.2 and earlier, suffers from a high-severity XSS vulnerability. The plugin fails to escape JUnit test contents when displayed in the Jenkins UI, thereby enabling attackers to execute XSS attacks. The recent patch ensures proper sanitization and mitigation of this vulnerability.

Versions 0.4 and earlier of the Shortcut Job plugin exhibit an XSS (cross-site scripting) flaw. This arises from the plugin’s failure to adequately escape the shortcut redirection URL. The vulnerability allows attackers to inject malicious code into the Jenkins UI, posing a significant security risk. The latest patch rectifies this flaw.

Furthermore, an additional high-severity XSS vulnerability has surfaced in the Docker Swarm plugin. Versions 1.11 and earlier of this plugin do not adequately sanitize values returned from Docker before they are inserted into the Docker Swarm Dashboard view. This vulnerability has been promptly addressed by Jenkins’ latest patch.

Medium-severity vulnerabilities and patches

Jenkins has also identified and addressed medium-severity vulnerabilities in various plugins, including:

1. Folders Plugin:
Apart from the high-severity vulnerability mentioned earlier, this plugin is susceptible to information disclosure, CSRF attacks, and HTML injection. Jenkins has provided patches to effectively mitigate these risks.

2. Config File Provider Plugin:
The Config File Provider plugin has vulnerabilities that may lead to credential leaks and CSRF attacks. Jenkins has released patches to address these issues, ensuring user credentials remain secure.

3. Node.js Plugin:
The Node.js plugin, if left unpatched, could result in information disclosure and CSRF attacks. The latest update resolves these vulnerabilities, safeguarding sensitive data.

4. Blue Ocean Plugin:
Another plugin affected by CSRF attacks and potential credential ID enumeration is Blue Ocean. Jenkins’ latest patches address these medium-severity vulnerabilities.

5. Fortify Plugin:
The Fortify plugin possesses vulnerabilities that could result in information disclosure and CSRF attacks. The patches offered by Jenkins effectively address these risks.

6. Delphix Plugin:
Similar to the other plugins mentioned, the Delphix plugin has medium-severity vulnerabilities that could lead to information disclosure and CSRF attacks. Jenkins’ patches ensure the plugin’s functionality remains secure.

Medium-severity vulnerabilities without patches

However, Jenkins warns that three medium-severity vulnerabilities in specific plugins have yet to receive patches. These plugins include the Maven Artifact ChoiceListProvider (Nexus), Gogs, and Favorite View plugins. These vulnerabilities may potentially expose credentials, disclose sensitive information, or facilitate CSRF attacks. Users are advised to remain vigilant and consider appropriate mitigating measures until patches become available.

Low-severity vulnerabilities and patches

Lastly, Jenkins has also addressed a low-severity vulnerability in the Tuleap Authentication plugin. The vulnerability allowed attackers to obtain a valid authentication token. This security flaw has been fixed in the latest patch, ensuring the plugin’s functionality remains secure.

Jenkins has demonstrated its commitment to proactively addressing vulnerabilities by releasing patches for high- and medium-severity security flaws in multiple plugins. However, users are urged to stay vigilant and apply the necessary patches promptly to ensure the utmost security of their Jenkins installations. Additionally, awareness of the three medium-severity vulnerabilities without patches is vital, and users should take extra precautions to mitigate potential risks. By staying proactive in addressing security concerns, the Jenkins community can continue to rely on a secure and robust automation server.

Explore more

What Are the Best Data Engineering Tools Today?

The rapid evolution of data engineering tools has redefined how organizations collect, handle, and interpret data, greatly enhancing their analytics capabilities. As data landscapes grow increasingly complex, the need for efficient data engineering solutions has never been more pronounced. These tools form the backbone of any data-driven strategy, enabling companies to structure their vast data sources into meaningful insights. Data

What Are the Key Data Science Trends Revolutionizing 2025?

In the rapidly evolving landscape of data science, groundbreaking shifts are redefining how industries approach analytics and decision-making, particularly in 2025. The confluence of technological advancements in machine learning, artificial intelligence, and data processing is reshaping every corner of the business world, leaving an indelible mark on strategies and operations. As organizations grapple with vast data accumulation and heightened demand

AI’s Transformative Role in Beginner Data Analytics

Artificial Intelligence (AI) plays a significant role in reshaping the landscape of data analytics, especially for beginners. As AI continues to advance, understanding its impact becomes crucial for newcomers in the field. With AI-powered tools rapidly evolving, mastering these innovations is essential for anyone aiming to excel in data analytics. This guide explores best practices that help beginners leverage AI

Will Click to Pay Revolutionize Online Payments in Australia?

In an age where online transactions have become a cornerstone of commerce, Australian Payments Plus (AP+) is embarking on a landmark initiative to transform digital payments. With the introduction of Click to Pay, an innovative debit card payment solution, AP+, in partnership with Giesecke+Devrient (G+D), aims to address key pain points in online shopping. This initiative promises to revolutionize the

AI Revolutionizes Global Telecom Roaming Optimization

In the rapidly evolving landscape of telecommunications, Shreyash Taywade emerges as a leading figure, spearheading a transformative initiative that leverages artificial intelligence (AI) and machine learning (ML) to revolutionize international roaming optimization. As the demand for seamless connectivity and mobile data usage continues to rise exponentially, largely due to data-intensive applications, pervasive cloud services, and the escalating presence of Internet