According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

  - Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in     the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.
    (CVE-2022-38663)

  - Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on     the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability     exploitable by attackers able to configure job names. (CVE-2022-38664)

  - Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global     configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins     controller file system. (CVE-2022-38665)

  - Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
    (CVE-2021-25738)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Jenkins plugins Multiple Vulnerabilities (2022-08-23)

medium Nessus Plugin ID 164452

Version 1.5

Version 1.4

Version 1.3

Version 1.5 Oct 4, 2024, 1:49 AM Plugin metadata Plugin Feed: 202410040149
Version 1.4 Jun 5, 2024, 10:55 AM Required Scan configuration ("Enable cgi scanning" set to "True") Plugin Feed: 202406051055
Version 1.3 Jul 28, 2023, 9:58 AM Logic Changes (adjusted to match vcf_extras.inc and jenkins_detect.inc changes) Plugin Feed: 202307280958