Jenkins Plugin Security Advisory: XSS, SSRF, Privilege Escalation (SECURITY-2954, SECURITY-3010, etc.)

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Description: - Script Security Plugin Missing permission check vulnerability: Script Security Plugin version 1367.vdf2fc45f229c and earlier (excluding 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776) lacks permission checks when implementing form validation methods. - Pipeline: Groovy Plugin Rebuilding a run with revoked script approval allowed: Pipeline: Groovy Plugin version 3990.vd281dd77a_388 and earlier (excluding 3975.3977.v478dd9e956c3) does not check whether the main (Jenkinsfile) script has been revoked during rebuild operations. - Pipeline: Declarative Plugin Restarting a run with revoked script approval allowed: Pipeline: Declarative Plugin version 2.2214.vb_b_34b_2ea_9b_83 and earlier does not verify if the main (Jenkinsfile) script has been revoked when restarting a build from a specific stage. - Authorize Project Plugin Stored XSS vulnerability: Authorize Project Plugin version 1.7.2 and earlier evaluates strings containing JavaScript in the authorization view. - OpenID Connect Authentication Plugin Session fixation vulnerability: OpenID Connect Authentication Plugin version 4.418.vccc7061f5b_6d and earlier does not clear existing sessions during login. - IvyTrigger Plugin XXE vulnerability: IvyTrigger Plugin version 1.01 and earlier bundles Apache Ivy affected by CVE-2022-46751. - Shared Library Version Override Plugin Script security bypass vulnerability: Shared Library Version Override Plugin version 17.v786074c9fce7 and earlier declares trusted folder-level library overrides, thus bypassing script security sandbox enforcement. 2. Vulnerability Severity: - High: SECURITY-2954, SECURITY-3010, SECURITY-3361, SECURITY-3362, SECURITY-3466, SECURITY-3473 - Medium: SECURITY-3447 3. Affected Versions: - Authorize Project Plugin: 1.7.2 and earlier - IvyTrigger Plugin: 1.01 and earlier - OpenID Connect Authentication Plugin: 4.418.vccc7061f5b_6d and earlier - Pipeline: Declarative Plugin: 2.2214.vb_b_34b_2ea_9b_83 and earlier - Pipeline: Groovy Plugin: 3990.vd281dd77a_388 and earlier - Script Security Plugin: 1367.vdf2fc45f229c and earlier - Shared Library Version Override Plugin: 17.v786074c9fce7 and earlier 4. Remediation: - Update the affected plugins to their latest versions to fix the vulnerabilities. This information helps users identify which plugins have security vulnerabilities and how to remediate them by upgrading to the latest versions.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Plugin Security Advisory: XSS, SSRF, Privilege Escalation (SECURITY-2954, SECURITY-3010, etc.)