Jenkins Multiple Plugins Vulnerabilities Advisory: Credential Leakage, XSS, Injection

Critical Vulnerability Information Vulnerability Description Improper Credential Labeling in Credentials Binding Plugin - Description: In certain cases, credentials may not be properly labeled, leading to exposure of sensitive information. - Example: When using the step, if credentials are not correctly labeled, they may appear in logs. File Path Information Leakage in HTML Publisher Plugin - Description: The plugin may expose file path information in HTML output. - Example: Generated HTML files may include absolute paths on the server. Lack of Input Validation for Git Parameters in Git Parameter Plugin - Description: The plugin lacks validation for Git parameter values, potentially leading to injection attacks. - Example: Malicious users can trigger security issues by providing specific parameter values. API Keys, Tokens, or Credentials Stored and Displayed in Plain Text in Multiple Plugins - Plugins affected: Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadypAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, Testigma Test Plan Runner Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza DexCloud Plugin, Kryptonite Plugin, Sentridus API Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacial Plugin - Description: These plugins store and display sensitive information (such as API keys, tokens) in plain text, increasing the risk of misuse. 例: API keys are directly visible in configuration files or logs. Stored XSS Vulnerability in Applitools Eyes Plugin - Description: The plugin contains a stored XSS vulnerability, allowing attackers to inject malicious scripts. - Example: Attackers can execute arbitrary JavaScript code on pages via specific inputs. Severity High: Aqua Security Scanner Plugin, Statistics Gathering Plugin, ReadypAPI Functional Testing Plugin, Applitools Eyes Plugin, Qmetry Test Management Plugin, IFTTT Build Notifier Plugin, IBM Cloud DevOps Plugin, Spice Loadtest Plugin, Dead Man's Snitch Plugin, Maddy Plugin, Novoza DexCloud Plugin, Kryptonite Plugin, Sentridus API Plugin, Warrior Framework Plugin, Xoon Plugin, Userlist Ufacial Plugin Medium: Credentials Binding Plugin, HTML Publisher Plugin, Git Parameter Plugin Affected Versions Specific versions of Jenkins and multiple plugins are affected; exact version numbers should be referenced in the official advisory. Mitigation Measures Update affected Jenkins plugins to the latest versions. Review and harden plugin configurations to avoid storing and displaying sensitive information in plain text. Implement strict input validation to prevent injection attacks. Deploy web application firewalls and other protective measures to reduce risks from XSS and similar attacks. Acknowledgments Thank you to the security researchers and community members who discovered and reported these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Multiple Plugins Vulnerabilities Advisory: Credential Leakage, XSS, Injection