Jenkins Security Advisory: Multiple Plugin Vulnerabilities (XSS, CSRF, XXE) CVE-2020-2238-2248

Jenkins Security Advisory 2020-09-01 This advisory announces vulnerabilities in the following Jenkins deliverables: Build Failure Analyzer Plugin Cadence vManager Plugin Database Plugin Git Parameter Plugin JSGames Plugin Klocwork Analysis Plugin Parameterized Remote Trigger Plugin ReadyAPI Functional Testing Plugin tfs Plugin Valgrind Plugin Descriptions Stored XSS vulnerability in Git Parameter Plugin SEVERITY-1884 / CVE-2020-2238 Severity (CVSS): High Affected plugin: git-parameter Secret stored in plain text by Parameterized Remote Trigger Plugin SEVERITY-1625 / CVE-2020-2239 Severity (CVSS): Low Affected plugin: Parameterized-Remote-Trigger CSRF vulnerability in Database Plugin SEVERITY-1023 / CVE-2020-2240 Severity (CVSS): High Affected plugin: database CSRF vulnerability and missing permission checks in Database Plugin SECURITY-1024 / CVE-2020-2241 (CSRF), CVE-2020-2242 (permission check) Severity (CVSS): Medium Affected plugin: database Stored XSS vulnerability in Cadence vManager Plugin SEVERITY-1936 / CVE-2020-2243 Severity (CVSS): High Affected plugin: vmanager-plugin XSS vulnerability in Build Failure Analyzer Plugin SECURITY-1770 / CVE-2020-2244 Severity (CVSS): High Affected plugin: build-failure-analyzer XXE vulnerability in Valgrind Plugin SECURITY-1829 / CVE-2020-2245 Severity (CVSS): High Affected plugin: valgrind Stored XSS vulnerability in Valgrind Plugin SECURITY-1830 / CVE-2020-2246 Severity (CVSS): High Affected plugin: valgrind XXE vulnerability in Klocwork Analysis Plugin SECURITY-1831 / CVE-2020-2247 Severity (CVSS): High Affected plugin: klocwork Reflected XSS vulnerability in JSGames Plugin SECURITY-1905 / CVE-2020-2248 Severity (CVSS): High Affected plugin: jsgames Credentials stored in plain text by tfs Plugin SECURITY-1506 / CVE-2020-2249 Severity (CVSS): Low Affected plugin: tfs Passwords stored in plain text by ReadyAPI Functional Testing Plugin SECURITY-1631 (1) / CVE-2020-2250 Severity (CVSS): Medium Affected plugin: soapui-pro-functional-testing Passwords transmitted in plain text by ReadyAPI Functional Testing Plugin SECURITY-1631 (2) / CVE-2020-2251 Severity (CVSS): Medium Affected plugin: soapui-pro-functional-testing Severity SECURITY-1023: High SECURITY-1024: Medium SECURITY-1506: Low SECURITY-1625: Low SECURITY-1631 (1): Medium SECURITY-1631 (2): Medium SECURITY-1770: High SECURITY-1829: High SECURITY-1830: High SECURITY-1831: High SECURITY-1884: High SECURITY-1905: High SECURITY-1936: High Affected Versions Build Failure Analyzer Plugin up to and including 1.27.0 Cadence vManager Plugin up to and including 3.0.4 Database Plugin up to and including 1.6 Git Parameter Plugin up to and including 0.9.12 JSGames Plugin up to and including 0.2 Klocwork Analysis Plugin up to and including 2020.2.1 Parameterized Remote Trigger Plugin up to and including 3.1.3 ReadyAPI Functional Testing Plugin up to and including 1.3 ReadyAPI Functional Testing Plugin up to and including 1.5 tfs Plugin up to and including 5.157.1 Valgrind Plugin up to and including 0.28 Fix Build Failure Analyzer Plugin should be updated to version 1.27.1 Cadence vManager Plugin should be updated to version 3.0.5 Database Plugin should be updated to version 1.7 Git Parameter Plugin should be updated to version 0.9.13 Parameterized Remote Trigger Plugin should be updated to version 3.1.4 ReadyAPI Functional Testing Plugin should be updated to version 1.4 These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: Multiple Plugin Vulnerabilities (XSS, CSRF, XXE) CVE-2020-2238-2248