Giter VIP home page Giter VIP logo

job-dsl-plugin's Introduction

Jenkins Job DSL Plugin

Introduction

Jenkins is a wonderful system for managing builds, and people love using its UI to configure jobs. Unfortunately, as the number of jobs grows, maintaining them becomes tedious, and the paradigm of using a UI falls apart. Additionally, the common pattern in this situation is to copy jobs to create new ones, these "children" have a habit of diverging from their original "template" and consequently it becomes difficult to maintain consistency between these jobs.

The Job DSL plugin attempts to solve this problem by allowing jobs to be defined in a programmatic form in a human readable file. Writing such a file is feasible without being a Jenkins expert as the configuration from the web UI translates intuitively into code.

configuration form

The job configuration above can be generated from the following code.

pipelineJob('job-dsl-plugin') {
  definition {
    cpsScm {
      scm {
        git {
          remote {
            url('https://github.com/jenkinsci/job-dsl-plugin.git')
          }
          branch('*/master')
        }
      }
      lightweight()
    }
  }
}

Job DSL was one of the first popular plugins for Jenkins which allows managing configuration as code and many other plugins dealing with this aspect have been created since then, most notably the Jenkins Pipeline and Configuration as Code plugins. It is important to understand the differences between these plugins and Job DSL for managing Jenkins configuration efficiently.

The Pipeline plugins support implementing and integrating continuous delivery pipelines via the Pipeline DSL. While it is possible to use Job DSL to create complex pipelines using freestyle jobs in combination with many plugins from the Jenkins ecosystem, creating and maintaining these pipeline, including generating jobs for individual SCM branches and possibly running steps in parallel to improve build performance, poses a significant challenge. Jenkins Pipeline is often the better choice for creating complex automated processes. Job DSL can be used to create Pipeline and Multibranch Pipeline jobs. Do not confuse Job DSL with Pipeline DSL, both have their own syntax and scope of application.

The Configuration as Code plugin can be used to manage the global system configuration of Jenkins. It comes with an integration for Job DSL to create an initial set of jobs.

Getting Started

First, start a Jenkins instance with the Job DSL plugin installed.

Then create a freestyle project named "seed".

configuration form

Add a "Process Job DSLs" build step and paste the script below into the "DSL Script" field.

job('example') {
  steps {
    shell('echo Hello World!')
  }
}

When running Jenkins on Windows, replace the shell step by a batchFile step.

job('example') {
  steps {
    batchFile('echo Hello World!')
  }
}

configuration form

Save the configuration, start a build and inspect the console output.

Started by user admin
Running as SYSTEM
Building in workspace /var/jenkins_home/workspace/seed
Processing provided DSL script
Added items:
    GeneratedJob{name='example'}
Finished: SUCCESS

The seed job has generated the "example" job. Verify the result on the job's configuration page.

generated job

Instead of creating a seed job manually, consider using the Configuration as Code plugin. See the Wiki for details.

Documentation

The complete DSL API reference is available in your Jenkins installation at https://your.jenkins.installation/plugin/job-dsl/api-viewer/index.html. You can find links to the API reference on the seed job page and the Job DSL build step.

A limited sub-set of the API reference is available online at https://jenkinsci.github.io/job-dsl-plugin/. But be aware that this does not show all API that is available in your Jenkins installation because a lot of the documentation is generated at runtime by introspecting the plugins that have been installed.

Jenkins saves the configuration of each job in a XML file. The Job DSL plugin is in principle a generator for these XML files, translating the DSL code into XML. If a configuration option is not available in the high-level DSL, it is possible to generate the XML directly using a Configure Block. Use the Job DSL Playground to create and test your configure blocks. Please note that the playground only supports the DSL API that is available in the online API Reference.

Find the complete documentation on the Wiki.

Release Notes

See the Wiki.

Community

Browse the collection of talks and blog posts about Job DSL. If you have a talk or blog post to share, please raise a hand, e.g. by posting to the mailing list.

Head over to Stack Overflow or the mailing list to get help.

Use the Issue Tracker for reporting bugs and making feature requests. Select the job-dsl-plugin component when searching or creating issues.

You can actively help to improve Job DSL by contributing code, documentation and tests or by reviewing and testing upcoming changes on GitHub. Start by reading the guidelines for contributors.

Please use the mailing list to provide feedback.

job-dsl-plugin's People

Contributors

abayer avatar andrewharmellaw avatar ceilfors avatar christiangalsterer avatar darxriggs avatar daspilker avatar declension avatar imod avatar jeremymarshall avatar jglick avatar joshuaspence avatar kamilszymanski avatar khmarbaise avatar ki82 avatar kmarquardsen avatar ldez avatar marc-guenther avatar marksymsctx avatar martinmosegaard avatar nobeh avatar oker1 avatar pauxus avatar quidryan avatar rborer avatar sgtcoolguy avatar sheehan avatar talanc avatar v1v avatar vjanelle avatar wolfs avatar

job-dsl-plugin's Issues

CVE-2020-11979 (High) detected in ant-1.9.2.jar - autoclosed

CVE-2020-11979 - High Severity Vulnerability

Vulnerable Library - ant-1.9.2.jar

master POM

Library home page: http://ant.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.ant/ant/1.9.2/112cf195dec0bd2b7967b5711b88c880b6640d86/ant-1.9.2.jar

Dependency Hierarchy:

  • jenkins-war-2.176.war (Root Library)
    • jenkins-core-2.176.jar
      • ant-1.9.2.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

Publish Date: 2020-10-01

URL: CVE-2020-11979

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://ant.apache.org/security.html

Release Date: 2020-10-01

Fix Resolution: org.apache.ant:ant:1.10.9

CVE-2021-21609 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2021-21609 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly match requested URLs to the list of always accessible paths, allowing attackers without Overall/Read permission to access some URLs as if they did have Overall/Read permission.

Publish Date: 2021-01-13

URL: CVE-2021-21609

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2021-01-13/

Release Date: 2021-01-13

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-2162 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2020-2162 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS vulnerability.

Publish Date: 2020-03-25

URL: CVE-2020-2162

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1793

Release Date: 2020-03-25

Fix Resolution: jenkins_2.228,LTS_2.204.6


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-1003011 (High) detected in token-macro-2.0.jar - autoclosed

CVE-2019-1003011 - High Severity Vulnerability

Vulnerable Library - token-macro-2.0.jar

The Jenkins Plugins Parent POM Project

Library home page: http://wiki.jenkins-ci.org/display/JENKINS/Token+Macro+Plugin

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/token-macro/2.0/e7d42aefb157f1181eb2b507077caa9d294659a1/token-macro-2.0.jar,/caches/modules-2/files-2.1/org.jenkins-ci.plugins/token-macro/2.0/e7d42aefb157f1181eb2b507077caa9d294659a1/token-macro-2.0.jar

Dependency Hierarchy:

  • token-macro-2.0.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.

Publish Date: 2019-02-06

URL: CVE-2019-1003011

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102

Release Date: 2019-02-06

Fix Resolution: org.jenkins-ci.plugins:token-macro:2.6


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-2163 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2020-2163 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers.

Publish Date: 2020-03-25

URL: CVE-2020-2163

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1796

Release Date: 2020-03-25

Fix Resolution: jenkins_2.228,LTS_2.204.6


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2013-6430 (Medium) detected in spring-web-2.5.6.SEC03.jar - autoclosed

CVE-2013-6430 - Medium Severity Vulnerability

Vulnerable Library - spring-web-2.5.6.SEC03.jar

Spring Framework: Web

Library home page: http://www.springframework.org

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/2.5.6.SEC03/699f171339f20126f1d09dde2dd17d6db2943fce/spring-web-2.5.6.SEC03.jar

Dependency Hierarchy:

  • jenkins-war-2.176.war (Root Library)
    • jenkins-core-2.176.jar
      • spring-webmvc-2.5.6.SEC03.jar
        • spring-web-2.5.6.SEC03.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.

Publish Date: 2020-01-10

URL: CVE-2013-6430

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6430

Release Date: 2020-01-10

Fix Resolution: 3.1.5,3.2.2

CVE-2020-2226 (Medium) detected in matrix-auth-1.3.jar - autoclosed

CVE-2020-2226 - Medium Severity Vulnerability

Vulnerable Library - matrix-auth-1.3.jar

Offers matrix-based security authorization strategies (global and per-project).

Library home page: http://wiki.jenkins-ci.org/display/JENKINS/Matrix+Authorization+Strategy+Plugin

Path to dependency file: /build.gradle

Path to vulnerable library: /build.gradle

Dependency Hierarchy:

  • matrix-auth-1.3.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.

Publish Date: 2020-07-15

URL: CVE-2020-2226

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2020-07-15/

Release Date: 2020-07-22

Fix Resolution: org.jenkins-ci.plugins:matrix-auth:2.6.2


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-1003014 (Medium) detected in config-file-provider-2.15.4.jar - autoclosed

CVE-2019-1003014 - Medium Severity Vulnerability

Vulnerable Library - config-file-provider-2.15.4.jar

Ability to provide configuration files (e.g. settings.xml for maven, XML, groovy, custom files,...) loaded through the UI which will be copied to the job workspace

Library home page: https://wiki.jenkins-ci.org/display/JENKINS/Config+File+Provider+Plugin

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/config-file-provider/2.15.4/e2842290509834dfe887974be83209d90eb0b5c2/config-file-provider-2.15.4.jar,/caches/modules-2/files-2.1/org.jenkins-ci.plugins/config-file-provider/2.15.4/e2842290509834dfe887974be83209d90eb0b5c2/config-file-provider-2.15.4.jar

Dependency Hierarchy:

  • config-file-provider-2.15.4.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.

Publish Date: 2019-02-06

URL: CVE-2019-1003014

CVSS 3 Score Details (4.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://jenkins.io/security/advisory/2019-01-28/

Release Date: 2019-02-06

Fix Resolution: org.jenkins-ci.plugins:config-file-provider:3.5


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-35517 (High) detected in commons-compress-1.10.jar - autoclosed

CVE-2021-35517 - High Severity Vulnerability

Vulnerable Library - commons-compress-1.10.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE and ar, cpio, jar, tar, zip, dump, 7z, arj.

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-compress/1.10/5eeb27c57eece1faf2d837868aeccc94d84dcc9a/commons-compress-1.10.jar

Dependency Hierarchy:

  • jenkins-war-2.176.war (Root Library)
    • jenkins-core-2.176.jar
      • commons-compress-1.10.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

Publish Date: 2021-07-13

URL: CVE-2021-35517

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://commons.apache.org/proper/commons-compress/security-reports.html

Release Date: 2021-07-13

Fix Resolution: org.apache.commons:commons-compress:1.21

CVE-2020-2220 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2020-2220 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Publish Date: 2020-07-15

URL: CVE-2020-2220

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2020-07-15/

Release Date: 2020-07-15

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.235.2,2.245


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-28169 (Medium) detected in jetty-server-9.4.25.v20191220.jar, jetty-http-9.4.25.v20191220.jar - autoclosed

CVE-2021-28169 - Medium Severity Vulnerability

Vulnerable Libraries - jetty-server-9.4.25.v20191220.jar, jetty-http-9.4.25.v20191220.jar

jetty-server-9.4.25.v20191220.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190450/jetty-server-9.4.25.v20191220.jar

Dependency Hierarchy:

  • jenkins-test-harness-2.60.jar (Root Library)
    • jetty-webapp-9.4.25.v20191220.jar
      • jetty-servlet-9.4.25.v20191220.jar
        • jetty-security-9.4.25.v20191220.jar
          • jetty-server-9.4.25.v20191220.jar (Vulnerable Library)
jetty-http-9.4.25.v20191220.jar

The Eclipse Jetty Project

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190450/jetty-http-9.4.25.v20191220.jar

Dependency Hierarchy:

  • jenkins-test-harness-2.60.jar (Root Library)
    • websocket-server-9.4.25.v20191220.jar
      • jetty-http-9.4.25.v20191220.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Publish Date: 2021-06-09

URL: CVE-2021-28169

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gwcr-j4wh-j3cq

Release Date: 2021-06-09

Fix Resolution: org.eclipse.jetty:jetty-runner:9.4.41.v20210516, 10.0.3, 11.0.3, org.eclipse.jetty:jetty-http:9.4.41.v20210516, 10.0.3, 11.0.3,org.eclipse.jetty:jetty-servlets:9.4.41.v20210516, 10.0.3, 11.0.3, org.eclipse.jetty:jetty-server:9.4.41.v20210516, 10.0.3, 11.0.3

CVE-2017-15708 (Critical) detected in commons-collections-3.2.jar - autoclosed

CVE-2017-15708 - Critical Severity Vulnerability

Vulnerable Library - commons-collections-3.2.jar

Types that extend and augment the Java Collections Framework.

Library home page: http://jakarta.apache.org/commons/collections/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190452/commons-collections-3.2.jar

Dependency Hierarchy:

  • vsphere-cloud-1.1.11.jar (Root Library)
    • json-lib-2.1-rev7.jar
      • commons-collections-3.2.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.

Publish Date: 2017-12-11

URL: CVE-2017-15708

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15708

Release Date: 2017-12-10

Fix Resolution: org.apache.synapse:Apache-Synapse:3.0.1;commons-collections:commons-collections:3.2.2

CVE-2018-1000153 (High) detected in vsphere-cloud-1.1.11.jar - autoclosed

CVE-2018-1000153 - High Severity Vulnerability

Vulnerable Library - vsphere-cloud-1.1.11.jar

Integrates Jenkins with a vSphere server

Library home page: https://wiki.jenkins-ci.org/display/JENKINS/vSphere+Cloud+Plugin

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.plugins/vsphere-cloud/1.1.11/ce1dbc4687789f8b122062224b70c3cbbbbfb43/vsphere-cloud-1.1.11.jar

Dependency Hierarchy:

  • vsphere-cloud-1.1.11.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection").

Publish Date: 2018-04-05

URL: CVE-2018-1000153

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000153

Release Date: 2018-04-05

Fix Resolution: org.jenkins-ci.plugins:vsphere-cloud:2.17


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-15250 (Medium) detected in junit-4.12.jar - autoclosed

CVE-2020-15250 - Medium Severity Vulnerability

Vulnerable Library - junit-4.12.jar

JUnit is a unit testing framework for Java, created by Erich Gamma and Kent Beck.

Library home page: http://junit.org

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/junit/junit/4.12/2973d150c0dc1fefe998f834810d68f278ea58ec/junit-4.12.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/junit/junit/4.12/2973d150c0dc1fefe998f834810d68f278ea58ec/junit-4.12.jar

Dependency Hierarchy:

  • junit-4.12.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.

Publish Date: 2020-10-12

URL: CVE-2020-15250

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-269g-pwp5-87pp

Release Date: 2020-10-12

Fix Resolution: 4.13.1


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-2222 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2020-2222 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting vulnerability.

Publish Date: 2020-07-15

URL: CVE-2020-2222

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2020-07-15/

Release Date: 2020-07-15

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.235.2,2.245


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-8331 (Medium) detected in multiple libraries - autoclosed

CVE-2019-8331 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.4.js, bootstrap-3.3.4.jar, bootstrap-3.3.4.min.js

bootstrap-3.3.4.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.js

Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.js

Dependency Hierarchy:

  • bootstrap-3.3.4.js (Vulnerable Library)
bootstrap-3.3.4.jar

WebJar for Bootstrap

Library home page: http://webjars.org

Path to dependency file: /job-dsl-api-viewer/build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.webjars/bootstrap/3.3.4/13c43352e042f431e9454b2518ed55513c504eb9/bootstrap-3.3.4.jar

Dependency Hierarchy:

  • bootstrap-3.3.4.jar (Vulnerable Library)
bootstrap-3.3.4.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js

Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.3.4.min.js (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Publish Date: 2019-02-20

URL: CVE-2019-8331

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-02-20

Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2018-20677 (Medium) detected in multiple libraries - autoclosed

CVE-2018-20677 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.4.jar, bootstrap-3.3.4.js, bootstrap-3.3.4.min.js, https://source.codeaurora.org/quic/lc/infra/third_party/bootstrap/v3.3.4

bootstrap-3.3.4.jar

WebJar for Bootstrap

Library home page: http://webjars.org

Path to dependency file: /job-dsl-api-viewer/build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.webjars/bootstrap/3.3.4/13c43352e042f431e9454b2518ed55513c504eb9/bootstrap-3.3.4.jar

Dependency Hierarchy:

  • bootstrap-3.3.4.jar (Vulnerable Library)
bootstrap-3.3.4.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.js

Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.js

Dependency Hierarchy:

  • bootstrap-3.3.4.js (Vulnerable Library)
bootstrap-3.3.4.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js

Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.3.4.min.js (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Publish Date: 2019-01-09

URL: CVE-2018-20677

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20677

Release Date: 2019-01-09

Fix Resolution: 3.4.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2018-14040 (Medium) detected in multiple libraries - autoclosed

CVE-2018-14040 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.4.min.js, https://source.codeaurora.org/quic/lc/infra/third_party/bootstrap/v3.3.4, bootstrap-3.3.4.jar, bootstrap-3.3.4.js

bootstrap-3.3.4.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js

Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.3.4.min.js (Vulnerable Library)
bootstrap-3.3.4.jar

WebJar for Bootstrap

Library home page: http://webjars.org

Path to dependency file: /job-dsl-api-viewer/build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.webjars/bootstrap/3.3.4/13c43352e042f431e9454b2518ed55513c504eb9/bootstrap-3.3.4.jar

Dependency Hierarchy:

  • bootstrap-3.3.4.jar (Vulnerable Library)
bootstrap-3.3.4.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.js

Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.js

Dependency Hierarchy:

  • bootstrap-3.3.4.js (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Publish Date: 2018-07-13

URL: CVE-2018-14040

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2,org.webjars:bootstrap:3.4.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2018-1000151 (Medium) detected in vsphere-cloud-1.1.11.jar - autoclosed

CVE-2018-1000151 - Medium Severity Vulnerability

Vulnerable Library - vsphere-cloud-1.1.11.jar

Integrates Jenkins with a vSphere server

Library home page: https://wiki.jenkins-ci.org/display/JENKINS/vSphere+Cloud+Plugin

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.plugins/vsphere-cloud/1.1.11/ce1dbc4687789f8b122062224b70c3cbbbbfb43/vsphere-cloud-1.1.11.jar

Dependency Hierarchy:

  • vsphere-cloud-1.1.11.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default.

Publish Date: 2018-04-05

URL: CVE-2018-1000151

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-1000151

Release Date: 2018-04-05

Fix Resolution: org.jenkins-ci.plugins:vsphere-cloud - 2.17


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-10320 (Medium) detected in credentials-2.1.10.jar, credentials-2.1.4.jar - autoclosed

CVE-2019-10320 - Medium Severity Vulnerability

Vulnerable Libraries - credentials-2.1.10.jar, credentials-2.1.4.jar

credentials-2.1.10.jar

This plugin allows you to store credentials in Jenkins.

Library home page: http://wiki.jenkins-ci.org/display/JENKINS/Credentials+Plugin

Path to dependency file: /build.gradle

Path to vulnerable library: /build.gradle

Dependency Hierarchy:

  • credentials-2.1.10.jar (Vulnerable Library)
credentials-2.1.4.jar

This plugin allows you to store credentials in Jenkins.

Library home page: http://wiki.jenkins-ci.org/display/JENKINS/Credentials+Plugin

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.plugins/credentials/2.1.4/ecbbe517f49cb0031d1d32dfd38fb5c8871d5a36/credentials-2.1.4.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/credentials/2.1.4/ecbbe517f49cb0031d1d32dfd38fb5c8871d5a36/credentials-2.1.4.jar

Dependency Hierarchy:

  • credentials-2.1.4.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.

Publish Date: 2019-05-21

URL: CVE-2019-10320

CVSS 3 Score Details (4.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10320

Release Date: 2019-05-21

Fix Resolution: org.jenkins-ci.plugins:credentials:2.1.8


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2018-1199 (Medium) detected in spring-core-2.5.6.SEC03.jar - autoclosed

CVE-2018-1199 - Medium Severity Vulnerability

Vulnerable Library - spring-core-2.5.6.SEC03.jar

Spring Framework: Core

Library home page: http://www.springframework.org

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-core/2.5.6.SEC03/644a23805a7ea29903bde0ccc1cd1a8b5f0432d6/spring-core-2.5.6.SEC03.jar

Dependency Hierarchy:

  • jenkins-war-2.176.war (Root Library)
    • jenkins-core-2.176.jar
      • spring-core-2.5.6.SEC03.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.

Publish Date: 2018-03-16

URL: CVE-2018-1199

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1199

Release Date: 2018-01-29

Fix Resolution: org.springframework.security:spring-security-web:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE;org.springframework.security:spring-security-config:4.1.5.RELEASE,4.2.4.RELEASE,5.0.1.RELEASE;org.springframework:spring-core:4.3.14.RELEASE,5.0.3.RELEASE

CVE-2021-21607 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2021-21607 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit sizes provided as query parameters to graph-rendering URLs, allowing attackers to request crafted URLs that use all available memory in Jenkins, potentially leading to out of memory errors.

Publish Date: 2021-01-13

URL: CVE-2021-21607

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2021-01-13/

Release Date: 2021-01-13

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-2229 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2020-2229 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.

Publish Date: 2020-08-12

URL: CVE-2020-2229

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2020-08-12/

Release Date: 2020-08-12

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.235.4,2.252


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21610 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2021-21610 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup.

Publish Date: 2021-01-13

URL: CVE-2021-21610

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2021-01-13/

Release Date: 2021-01-13

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-1003040 (Critical) detected in script-security-1.54.jar - autoclosed

CVE-2019-1003040 - Critical Severity Vulnerability

Vulnerable Library - script-security-1.54.jar

Allows Jenkins administrators to control what in-process scripts can be run by less-privileged users.

Library home page: https://wiki.jenkins.io/display/JENKINS/Script+Security+Plugin

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.plugins/script-security/1.54/f3a86e493aadee03660779add827d0f6384d0120/script-security-1.54.jar

Dependency Hierarchy:

  • script-security-1.54.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

Publish Date: 2019-03-28

URL: CVE-2019-1003040

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1003040

Release Date: 2019-03-28

Fix Resolution: 1.56


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21615 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2021-21615 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.

Publish Date: 2021-01-26

URL: CVE-2021-21615

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2021-01-26/#SECURITY-2197

Release Date: 2021-01-26

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.263.3,2.276


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-2161 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2020-2161 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.

Publish Date: 2020-03-25

URL: CVE-2020-2161

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1781

Release Date: 2020-03-25

Fix Resolution: jenkins_2.228,LTS_2.204.6


⛑️ Automatic Remediation will be attempted for this issue.

WS-2019-0379 (Medium) detected in commons-codec-1.9.jar - autoclosed

WS-2019-0379 - Medium Severity Vulnerability

Vulnerable Library - commons-codec-1.9.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/commons-codec/commons-codec/1.9/9ce04e34240f674bc72680f8b843b1457383161a/commons-codec-1.9.jar

Dependency Hierarchy:

  • jenkins-war-2.176.war (Root Library)
    • jenkins-core-2.176.jar
      • commons-codec-1.9.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.

Publish Date: 2019-05-20

URL: WS-2019-0379

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-05-20

Fix Resolution: commons-codec:commons-codec:1.13

CVE-2021-21680 (High) detected in nested-view-1.14.jar - autoclosed

CVE-2021-21680 - High Severity Vulnerability

Vulnerable Library - nested-view-1.14.jar

Library home page: http://wiki.jenkins-ci.org/display/JENKINS/Nested+View+Plugin

Path to dependency file: /build.gradle

Path to vulnerable library: /build.gradle

Dependency Hierarchy:

  • nested-view-1.14.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.

Publish Date: 2021-08-31

URL: CVE-2021-21680

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2470

Release Date: 2021-08-31

Fix Resolution: org.jenkins-ci.plugins:nested-view:1.21


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2018-20676 (Medium) detected in multiple libraries - autoclosed

CVE-2018-20676 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.4.jar, https://source.codeaurora.org/quic/lc/infra/third_party/bootstrap/v3.3.4, bootstrap-3.3.4.js, bootstrap-3.3.4.min.js

bootstrap-3.3.4.jar

WebJar for Bootstrap

Library home page: http://webjars.org

Path to dependency file: /job-dsl-api-viewer/build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.webjars/bootstrap/3.3.4/13c43352e042f431e9454b2518ed55513c504eb9/bootstrap-3.3.4.jar

Dependency Hierarchy:

  • bootstrap-3.3.4.jar (Vulnerable Library)
bootstrap-3.3.4.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.js

Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.js

Dependency Hierarchy:

  • bootstrap-3.3.4.js (Vulnerable Library)
bootstrap-3.3.4.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js

Path to vulnerable library: /job-dsl-api-viewer/build/webjars/bootstrap/3.3.4/js/bootstrap.min.js

Dependency Hierarchy:

  • bootstrap-3.3.4.min.js (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

Publish Date: 2019-01-09

URL: CVE-2018-20676

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20676

Release Date: 2019-01-09

Fix Resolution: 3.4.0


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21611 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2021-21611 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.

Publish Date: 2021-01-13

URL: CVE-2021-21611

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2171

Release Date: 2021-01-13

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2017-1000104 (Medium) detected in config-file-provider-2.15.4.jar - autoclosed

CVE-2017-1000104 - Medium Severity Vulnerability

Vulnerable Library - config-file-provider-2.15.4.jar

Ability to provide configuration files (e.g. settings.xml for maven, XML, groovy, custom files,...) loaded through the UI which will be copied to the job workspace

Library home page: https://wiki.jenkins-ci.org/display/JENKINS/Config+File+Provider+Plugin

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.plugins/config-file-provider/2.15.4/e2842290509834dfe887974be83209d90eb0b5c2/config-file-provider-2.15.4.jar,/caches/modules-2/files-2.1/org.jenkins-ci.plugins/config-file-provider/2.15.4/e2842290509834dfe887974be83209d90eb0b5c2/config-file-provider-2.15.4.jar

Dependency Hierarchy:

  • config-file-provider-2.15.4.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read access to Jenkins were able to access URLs directly that allowed viewing these files. Access to view these files now requires sufficient permissions to configure the provided files, view the configuration of the folder in which the configuration files are defined, or have Job/Configure permissions to a job able to use these files.

Publish Date: 2017-10-05

URL: CVE-2017-1000104

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000104

Release Date: 2022-10-03

Fix Resolution: org.jenkins-ci.plugins:config-file-provider:2.16.2


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21605 (High) detected in jenkins-core-2.176.jar - autoclosed

CVE-2021-21605 - High Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml file.

Publish Date: 2021-01-13

URL: CVE-2021-21605

CVSS 3 Score Details (8.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2021-01-13/

Release Date: 2021-01-13

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-2160 (High) detected in jenkins-core-2.176.jar - autoclosed

CVE-2020-2160 - High Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs that allow bypassing CSRF protection of any target URL.

Publish Date: 2020-03-25

URL: CVE-2020-2160

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1774

Release Date: 2020-03-25

Fix Resolution: jenkins_2.228,LTS_2.204.6


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-28165 (High) detected in jetty-io-9.4.25.v20191220.jar - autoclosed

CVE-2021-28165 - High Severity Vulnerability

Vulnerable Library - jetty-io-9.4.25.v20191220.jar

The Eclipse Jetty Project

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190450/jetty-io-9.4.25.v20191220.jar

Dependency Hierarchy:

  • jenkins-test-harness-2.60.jar (Root Library)
    • websocket-server-9.4.25.v20191220.jar
      • websocket-client-9.4.25.v20191220.jar
        • jetty-io-9.4.25.v20191220.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Publish Date: 2021-04-01

URL: CVE-2021-28165

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-26vr-8j45-3r4w

Release Date: 2021-04-01

Fix Resolution: org.eclipse.jetty:jetty-io:9.4.39, org.eclipse.jetty:jetty-io:10.0.2, org.eclipse.jetty:jetty-io:11.0.2

CVE-2014-0054 (Medium) detected in spring-web-2.5.6.SEC03.jar - autoclosed

CVE-2014-0054 - Medium Severity Vulnerability

Vulnerable Library - spring-web-2.5.6.SEC03.jar

Spring Framework: Web

Library home page: http://www.springframework.org

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-web/2.5.6.SEC03/699f171339f20126f1d09dde2dd17d6db2943fce/spring-web-2.5.6.SEC03.jar

Dependency Hierarchy:

  • jenkins-war-2.176.war (Root Library)
    • jenkins-core-2.176.jar
      • spring-webmvc-2.5.6.SEC03.jar
        • spring-web-2.5.6.SEC03.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.

Publish Date: 2014-04-17

URL: CVE-2014-0054

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-0054

Release Date: 2014-04-17

Fix Resolution: org.springframework:spring-web:3.2.8.RELEASE,4.0.2.RELEASE,org.springframework:spring-oxm:4.0.2.RELEASE,3.2.8.RELEASE

CVE-2021-21606 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2021-21606 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier improperly validates the format of a provided fingerprint ID when checking for its existence allowing an attacker to check for the existence of XML files with a short path.

Publish Date: 2021-01-13

URL: CVE-2021-21606

CVSS 3 Score Details (4.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2021-01-13/

Release Date: 2021-01-13

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2014-3578 (Medium) detected in spring-core-2.5.6.SEC03.jar - autoclosed

CVE-2014-3578 - Medium Severity Vulnerability

Vulnerable Library - spring-core-2.5.6.SEC03.jar

Spring Framework: Core

Library home page: http://www.springframework.org

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.springframework/spring-core/2.5.6.SEC03/644a23805a7ea29903bde0ccc1cd1a8b5f0432d6/spring-core-2.5.6.SEC03.jar

Dependency Hierarchy:

  • jenkins-war-2.176.war (Root Library)
    • jenkins-core-2.176.jar
      • spring-core-2.5.6.SEC03.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.

Publish Date: 2015-02-19

URL: CVE-2014-3578

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-3578

Release Date: 2015-02-19

Fix Resolution: 3.2.9,4.0.5

CVE-2018-1000152 (Medium) detected in vsphere-cloud-1.1.11.jar - autoclosed

CVE-2018-1000152 - Medium Severity Vulnerability

Vulnerable Library - vsphere-cloud-1.1.11.jar

Integrates Jenkins with a vSphere server

Library home page: https://wiki.jenkins-ci.org/display/JENKINS/vSphere+Cloud+Plugin

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.plugins/vsphere-cloud/1.1.11/ce1dbc4687789f8b122062224b70c3cbbbbfb43/vsphere-cloud-1.1.11.jar

Dependency Hierarchy:

  • vsphere-cloud-1.1.11.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection").

Publish Date: 2018-04-05

URL: CVE-2018-1000152

CVSS 3 Score Details (6.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000152

Release Date: 2018-04-05

Fix Resolution: org.jenkins-ci.plugins:vsphere-cloud:2.17


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21602 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2021-21602 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows reading arbitrary files using the file browser for workspaces and archived artifacts by following symlinks.

Publish Date: 2021-01-13

URL: CVE-2021-21602

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452

Release Date: 2021-01-13

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2015-3253 (Medium) detected in groovy-all-2.3.11.jar - autoclosed

CVE-2015-3253 - Medium Severity Vulnerability

Vulnerable Library - groovy-all-2.3.11.jar

Groovy: A powerful, dynamic language for the JVM

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190449/groovy-all-2.3.11.jar

Dependency Hierarchy:

  • CodeNarc-1.2.jar (Root Library)
    • groovy-all-2.3.11.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

Publish Date: 2015-08-13

URL: CVE-2015-3253

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://groovy-lang.org/security.html

Release Date: 2015-08-13

Fix Resolution (org.codehaus.groovy:groovy-all): 2.4.4

Direct dependency fix Resolution (org.codenarc:CodeNarc): 1.5


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-34428 (Low) detected in jetty-server-9.4.25.v20191220.jar - autoclosed

CVE-2021-34428 - Low Severity Vulnerability

Vulnerable Library - jetty-server-9.4.25.v20191220.jar

The core jetty server artifact.

Library home page: http://www.eclipse.org/jetty

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190450/jetty-server-9.4.25.v20191220.jar

Dependency Hierarchy:

  • jenkins-test-harness-2.60.jar (Root Library)
    • jetty-webapp-9.4.25.v20191220.jar
      • jetty-servlet-9.4.25.v20191220.jar
        • jetty-security-9.4.25.v20191220.jar
          • jetty-server-9.4.25.v20191220.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Publish Date: 2021-06-22

URL: CVE-2021-34428

CVSS 3 Score Details (3.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Physical
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m6cp-vxjx-65j6

Release Date: 2021-06-22

Fix Resolution: org.eclipse.jetty:jetty-server:9.4.41.v20210516,10.0.3,11.0.3

CVE-2020-2223 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2020-2223 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.

Publish Date: 2020-07-15

URL: CVE-2020-2223

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2020-07-15/

Release Date: 2020-07-15

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.235.2,2.245


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-35516 (High) detected in commons-compress-1.10.jar - autoclosed

CVE-2021-35516 - High Severity Vulnerability

Vulnerable Library - commons-compress-1.10.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE and ar, cpio, jar, tar, zip, dump, 7z, arj.

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-compress/1.10/5eeb27c57eece1faf2d837868aeccc94d84dcc9a/commons-compress-1.10.jar

Dependency Hierarchy:

  • jenkins-war-2.176.war (Root Library)
    • jenkins-core-2.176.jar
      • commons-compress-1.10.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Publish Date: 2021-07-13

URL: CVE-2021-35516

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://commons.apache.org/proper/commons-compress/security-reports.html

Release Date: 2021-07-13

Fix Resolution: org.apache.commons:commons-compress:1.21

CVE-2014-0114 (High) detected in commons-beanutils-1.9.3.jar, commons-beanutils-1.7.0.jar - autoclosed

CVE-2014-0114 - High Severity Vulnerability

Vulnerable Libraries - commons-beanutils-1.9.3.jar, commons-beanutils-1.7.0.jar

commons-beanutils-1.9.3.jar

Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.

Library home page: https://commons.apache.org/proper/commons-beanutils/

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/commons-beanutils/commons-beanutils/1.9.3/c845703de334ddc6b4b3cd26835458cb1cba1f3d/commons-beanutils-1.9.3.jar

Dependency Hierarchy:

  • jenkins-war-2.176.war (Root Library)
    • jenkins-core-2.176.jar
      • commons-beanutils-1.9.3.jar (Vulnerable Library)
commons-beanutils-1.7.0.jar

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/ws-ua_20210927190226_TRFFHW/downloadResource_SQXZWB/20210927190451/commons-beanutils-1.7.0.jar

Dependency Hierarchy:

  • vsphere-cloud-1.1.11.jar (Root Library)
    • json-lib-2.1-rev7.jar
      • commons-beanutils-1.7.0.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Publish Date: 2014-04-30

URL: CVE-2014-0114

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114

Release Date: 2014-04-30

Fix Resolution: commons-beanutils:commons-beanutils:1.9.4;org.apache.struts:struts2-core:2.0.5

CVE-2020-2221 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2020-2221 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.

Publish Date: 2020-07-15

URL: CVE-2020-2221

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2020-07-15/

Release Date: 2020-07-15

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.235.2,2.245


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-35515 (High) detected in commons-compress-1.10.jar - autoclosed

CVE-2021-35515 - High Severity Vulnerability

Vulnerable Library - commons-compress-1.10.jar

Apache Commons Compress software defines an API for working with compression and archive formats. These include: bzip2, gzip, pack200, lzma, xz, Snappy, traditional Unix Compress, DEFLATE and ar, cpio, jar, tar, zip, dump, 7z, arj.

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-compress/1.10/5eeb27c57eece1faf2d837868aeccc94d84dcc9a/commons-compress-1.10.jar

Dependency Hierarchy:

  • jenkins-war-2.176.war (Root Library)
    • jenkins-core-2.176.jar
      • commons-compress-1.10.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Publish Date: 2021-07-13

URL: CVE-2021-35515

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://commons.apache.org/proper/commons-compress/security-reports.html

Release Date: 2021-07-13

Fix Resolution: org.apache.commons:commons-compress:1.21

CVE-2021-21604 (High) detected in jenkins-core-2.176.jar - autoclosed

CVE-2021-21604 - High Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows attackers with permission to create or configure various objects to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects once discarded by an administrator.

Publish Date: 2021-01-13

URL: CVE-2021-21604

CVSS 3 Score Details (8.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452

Release Date: 2021-01-13

Fix Resolution: org.jenkins-ci.main:jenkins-core:2.275, org.jenkins-ci.main:jenkins-core:LTS 2.263.2


⛑️ Automatic Remediation will be attempted for this issue.

CVE-2014-0107 (High) detected in xalan-2.6.0.jar - autoclosed

CVE-2014-0107 - High Severity Vulnerability

Vulnerable Library - xalan-2.6.0.jar

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/xalan/xalan/2.6.0/5b010b70e16d540dcb737caa09da1034ea721704/xalan-2.6.0.jar

Dependency Hierarchy:

  • jenkins-war-2.176.war (Root Library)
    • jenkins-core-2.176.jar
      • jaxen-1.1-beta-11.jar
        • xom-1.0b3.jar
          • xalan-2.6.0.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Publish Date: 2014-04-15

URL: CVE-2014-0107

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0107

Release Date: 2014-04-15

Fix Resolution: 2.7.2

CVE-2017-2602 (Medium) detected in jenkins-core-2.176.jar - autoclosed

CVE-2017-2602 - Medium Severity Vulnerability

Vulnerable Library - jenkins-core-2.176.jar

Jenkins core code and view files to render HTML.

Library home page: https://jenkins.io/jenkins-parent/jenkins-core/

Path to dependency file: /build.gradle

Path to vulnerable library: /caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar,/home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.jenkins-ci.main/jenkins-core/2.176/95ee06bed42207774c63dc8ead89f79f2a9daee9/jenkins-core-2.176.jar

Dependency Hierarchy:

  • jenkins-core-2.176.jar (Vulnerable Library)

Found in HEAD commit: 2e8946fc25b6060b5637631b8813fe86b6da687a

Found in base branch: master

Vulnerability Details

jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).

Publish Date: 2018-05-15

URL: CVE-2017-2602

CVSS 3 Score Details (4.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.securityfocus.com/bid/95952

Release Date: 2018-05-15

Fix Resolution: jenkins-2.32.2


⛑️ Automatic Remediation will be attempted for this issue.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.