Jenkins Developers Warn That 29 Plugins Contain 0-Day Vulnerabilities

The Jenkins security team announced the discovery of 34 vulnerabilities affecting 29 popular plugins. Worse, 29 of the problems found are 0-day vulnerabilities, so these are very fresh bugs, for which there is still no patches.

The developers say that according to the CVSS vulnerability rating scale, the severity of problems varies from low to high, and in total, vulnerable plugins are installed over 22,000 times.

Let me remind you that we also wrote that Critical PHP Vulnerability Allows Code to Run on Qnap Devices, and also that Critical 0-day vulnerability found in Spring Java framework.

The list of flaws that Jenkins now needs to fix included XSS, “stored” XSS, CSRF, missing or incorrect permission checks, and passwords, secrets, API keys, and tokens stored by plugins in plain text format.

Although none of the vulnerabilities are critical (such bugs allow attackers to remotely execute code or commands on vulnerable servers), the bugs found can still be used to attack corporate networks.

The Jenkins team has already submitted patches for four plugins (GitLab, request-plugin, TestNG Results, and XebiaLabs XL Release), but the list of vulnerable plugins is still long:

1. Build Notifications Plugin up to version 1.5.0 (inclusively);
2. build-metrics Plugin up to version 1.3 (inclusively);
3. Cisco Spark Plugin up to version 1.1.1 (inclusively);
4. Deployment Dashboard Plugin up to version 1.0.10 (inclusively);
5. Elasticsearch Query Plugin up to version 1.2 (inclusively);
6. eXtreme Feedback Panel Plugin up to version 2.0.1 (inclusively);
7. Failed Job Deactivator Plugin up to version 1.2.1 (inclusively);
8. GitLab Plugin up to version 1.5.34 (inclusively);
9. HPE Network Virtualization Plugin up to version 1.0 (inclusively);
10. Jigomerge Plugin up to version 0.9 (inclusively);
11. Matrix Reloaded Plugin up to version 1.1.3 (inclusively);
12. OpsGenie Plugin up to version 1.9 (inclusively);
13. Plot Plugin up to version 2.1.10 (inclusively);
14. Project Inheritance Plugin up to version 21.04.03 (inclusively);
15. Recipe Plugin up to version 1.2 (inclusively);
16. Request Rename or Delete Plugin up to version 1.1.0 (inclusively);
17. requests-plugin Plugin up to version 2.2.16 (inclusively);
18. Rich Text Publisher Plugin up to version 1.4 (inclusively);
19. RocketChat Notifier Plugin up to version 1.5.2 (inclusively);
20. RQM Plugin up to version 2.8 (inclusively);
21. Skype notifier Plugin up to version 1.1.0 (inclusively);
22. TestNG Results Plugin up to version 554.va4a552116332 (inclusively);
23. Validating Email Parameter Plugin up to version 1.10 (inclusively);
24. XebiaLabs XL Release Plugin up to version 22.0.0 (inclusively);
25. XPath Configuration Viewer Plugin up to version 1.1.1 (inclusively).