Jenkins
Jenkins Security Advisory 2018-09-25
2018-09-25 Sep 25, 2018 Source: Vendor
Imported by the Jenkins advisory catcher from https://www.jenkins.io/security/advisory/2018-09-25/. 21 SECURITY issues listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.jenkins.io/security/advisory/2018-09-25/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
16 lines
Showing 1–16 of 16
CVE-2018-1000415
BR2018-0000-020569
SECURITY-130
unclaimed
Stored XSS vulnerability in Rebuild Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000414
BR2018-0000-020570
SECURITY-938
unclaimed
CSRF vulnerability in Config File Provider Plugin
Credited as Daniel Beck, CloudBees, Inc.
Acknowledgement
BR2018-0000-020571
SECURITY-1108
unclaimed
CSRF vulnerability and missing permission checks in Dimensions Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000426
BR2018-0000-020572
SECURITY-1122
unclaimed
Stored XSS vulnerability in Git Changelog Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000417
BR2018-0000-020573
SECURITY-1125
unclaimed
CSRF vulnerability in Email Extension Template Plugin
Credited as Daniel Beck, CloudBees, Inc.
CVE-2018-1000416
BR2018-0000-020574
SECURITY-1130
unclaimed
Reflected XSS vulnerability in Job Config History Plugin
Credited as Daniel Beck, CloudBees, Inc.
Acknowledgement
BR2018-0000-020575
SECURITY-1011
unclaimed
SECURITY-1011
Credited as Oleg Nenashev, CloudBees, Inc.
CVE-2018-1000411
BR2018-0000-020576
SECURITY-1101
unclaimed
CSRF vulnerability in JUnit Plugin
Credited as Oleg Nenashev, CloudBees, Inc.
CVE-2018-1000424
BR2018-0000-020577
SECURITY-265
unclaimed
Artifactory Plugin stored old directly entered credentials unencrypted on disk
Credited as Steve Marlowe of Cisco ASIG
CVE-2018-1000425
BR2018-0000-020578
SECURITY-1163
unclaimed
SonarQube Scanner Plugin stored server authentication token in plain text
Credited as The CJE team from ABN-AMRO
Acknowledgement
BR2018-0000-020579
SECURITY-845
unclaimed
Publish Over Dropbox Plugin stored credentials in plain text
Credited as Viktor Gazdag
CVE-2018-1000422
BR2018-0000-020580
SECURITY-1067
unclaimed
Server-side request forgery vulnerability in Crowd 2 Integration Plugin
Credited as Viktor Gazdag
CVE-2018-1000423
BR2018-0000-020581
SECURITY-1068
unclaimed
Crowd 2 Integration Plugin stored credentials in plain text
Credited as Viktor Gazdag
CVE-2018-1000412
BR2018-0000-020582
SECURITY-1029
unclaimed
CSRF vulnerability and missing permission checks in Jira Plugin allowed capturing credentials
Credited as Wadeck Follonier, CloudBees, Inc.
Acknowledgement
BR2018-0000-020583
SECURITY-1075
unclaimed
Stored XSS vulnerability in Metadata Plugin
Credited as Zhouyuan Yang of Fortinet's FortiGuard Labs
CVE-2018-1000413
BR2018-0000-020584
SECURITY-1080
unclaimed
Stored XSS vulnerability in Config File Provider Plugin
Credited as Zhouyuan Yang of Fortinet's FortiGuard Labs