Jenkins Releases Patches for High-Severity Vulnerabilities in Multiple Plugins

Jenkins, the popular open-source automation server, has recently announced the availability of patches to address high- and medium-severity vulnerabilities impacting several plugins. These patches are crucial for maintaining the security and integrity of Jenkins installations. Among the vulnerabilities, three high-severity cross-site request forgery (CSRF) and cross-site scripting (XSS) issues have been identified in the Folders, Flaky Test Handler, and Shortcut Job plugins.

High-severity vulnerabilities and patches

The Folders plugin, specifically versions 6.846.v23698686f0f6 and earlier, contains a high-severity vulnerability. This flaw stems from the fact that no POST requests were required for an HTTP endpoint, leading to CSRF attacks. Jenkins has addressed this issue in the latest patch.

The Flaky Test Handler plugin, versions 1.2.2 and earlier, suffers from a high-severity XSS vulnerability. The plugin fails to escape JUnit test contents when displayed in the Jenkins UI, thereby enabling attackers to execute XSS attacks. The recent patch ensures proper sanitization and mitigation of this vulnerability.

Versions 0.4 and earlier of the Shortcut Job plugin exhibit an XSS (cross-site scripting) flaw. This arises from the plugin’s failure to adequately escape the shortcut redirection URL. The vulnerability allows attackers to inject malicious code into the Jenkins UI, posing a significant security risk. The latest patch rectifies this flaw.

Furthermore, an additional high-severity XSS vulnerability has surfaced in the Docker Swarm plugin. Versions 1.11 and earlier of this plugin do not adequately sanitize values returned from Docker before they are inserted into the Docker Swarm Dashboard view. This vulnerability has been promptly addressed by Jenkins’ latest patch.

Medium-severity vulnerabilities and patches

Jenkins has also identified and addressed medium-severity vulnerabilities in various plugins, including:

1. Folders Plugin:
Apart from the high-severity vulnerability mentioned earlier, this plugin is susceptible to information disclosure, CSRF attacks, and HTML injection. Jenkins has provided patches to effectively mitigate these risks.

2. Config File Provider Plugin:
The Config File Provider plugin has vulnerabilities that may lead to credential leaks and CSRF attacks. Jenkins has released patches to address these issues, ensuring user credentials remain secure.

3. Node.js Plugin:
The Node.js plugin, if left unpatched, could result in information disclosure and CSRF attacks. The latest update resolves these vulnerabilities, safeguarding sensitive data.

4. Blue Ocean Plugin:
Another plugin affected by CSRF attacks and potential credential ID enumeration is Blue Ocean. Jenkins’ latest patches address these medium-severity vulnerabilities.

5. Fortify Plugin:
The Fortify plugin possesses vulnerabilities that could result in information disclosure and CSRF attacks. The patches offered by Jenkins effectively address these risks.

6. Delphix Plugin:
Similar to the other plugins mentioned, the Delphix plugin has medium-severity vulnerabilities that could lead to information disclosure and CSRF attacks. Jenkins’ patches ensure the plugin’s functionality remains secure.

Medium-severity vulnerabilities without patches

However, Jenkins warns that three medium-severity vulnerabilities in specific plugins have yet to receive patches. These plugins include the Maven Artifact ChoiceListProvider (Nexus), Gogs, and Favorite View plugins. These vulnerabilities may potentially expose credentials, disclose sensitive information, or facilitate CSRF attacks. Users are advised to remain vigilant and consider appropriate mitigating measures until patches become available.

Low-severity vulnerabilities and patches

Lastly, Jenkins has also addressed a low-severity vulnerability in the Tuleap Authentication plugin. The vulnerability allowed attackers to obtain a valid authentication token. This security flaw has been fixed in the latest patch, ensuring the plugin’s functionality remains secure.

Jenkins has demonstrated its commitment to proactively addressing vulnerabilities by releasing patches for high- and medium-severity security flaws in multiple plugins. However, users are urged to stay vigilant and apply the necessary patches promptly to ensure the utmost security of their Jenkins installations. Additionally, awareness of the three medium-severity vulnerabilities without patches is vital, and users should take extra precautions to mitigate potential risks. By staying proactive in addressing security concerns, the Jenkins community can continue to rely on a secure and robust automation server.

Explore more

UK’s 5G Networks Lag Behind Europe in Quality and Coverage

In 2025, a digital challenge hovers over the UK as the nation grapples with underwhelming 5G network performance compared to its European counterparts. Recent analyses from MedUX, a firm specializing in mobile network assessment, have uncovered significant discrepancies between the UK’s target for 5G accessibility and real-world consumer experiences. While theoretical models predict widespread reach, everyday exchanges suggest a different

Shared 5G Standalone Spectrum – Review

The advent of 5G technology has revolutionized telecommunications by ushering in a new era of connectivity. Among these innovations, shared 5G Standalone (SA) spectrum emerges as a novel approach to address increasing data demands. With mobile data usage anticipated to rise to 54 GB per month by 2030, mainly due to indoor consumption, shared 5G SA spectrum represents a significant

How Does Magnati-RAKBANK Partnership Empower UAE SMEs?

The landscape for small and medium-sized enterprises (SMEs) in the UAE is witnessing a paradigm shift. Facing obstacles in accessing finance, SMEs now have a lifeline through the strategic alliance between Magnati and RAKBANK. This collaboration emerges as a pivotal force in transforming financial accessibility, employing advanced embedded finance services tailored to SMEs’ unique needs. It’s a partnership set to

How Does Azure Revolutionize Digital Transformation?

In today’s fast-paced digital era, businesses must swiftly adapt to remain competitive in the ever-evolving technological landscape. The concept of digital transformation has become essential for organizations seeking to integrate advanced technologies into their operations. One key player facilitating this transformation is Microsoft Azure, a cloud platform that’s enabling businesses across various sectors to modernize, scale, and innovate effectively. Through

Digital Transformation Boosts Efficiency in Water Utilities

In a world where water is increasingly scarce, the urgency for efficient water management has never been greater. The global water utilities sector, responsible for supplying this vital resource, is facing significant challenges. As demand is projected to surpass supply by 40% within the next decade, water utilities worldwide struggle with inefficiencies and high water loss, averaging losses of one-third