Detections
Analytics

Jenkins plugins Multiple Vulnerabilities (2025-04-02)

high Nessus Plugin ID 233778

Language:

Synopsis

An application running on a remote web server host is affected by multiple vulnerabilities

Description

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities:

 - In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. (CVE-2025-31722)

 - A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the build queue order. (CVE-2025-31723)

 - Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. (CVE-2025-31724)

 - Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. (CVE-2025-31725)

 - Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. (CVE-2025-31726)

 - Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. (CVE-2025-31727)

 - Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
 (CVE-2025-31728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update Jenkins plugins to the following versions:
 - AsakusaSatellite Plugin: See vendor advisory
 - Cadence vManager Plugin to version 4.0.1-286.v9e25a_740b_a_48 or later
 - monitor-remote-job Plugin: See vendor advisory
 - Simple Queue Plugin to version 1.4.7 or later
 - Stack Hammer Plugin: See vendor advisory
 - Templating Engine Plugin to version 2.5.4 or later

See vendor advisory for more details.

See Also

https://jenkins.io/security/advisory/2025-04-02

Plugin Details

Severity: High

ID: 233778

File Name: jenkins_security_advisory_2025-04-02_plugins.nasl

Version: 1.1

Type: combined

Agent: windows, macosx, unix

Family: CGI abuses

Published: 4/2/2025

Updated: 4/2/2025

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Nessus

Enable CGI Scanning: true

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-31722

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:jenkins:jenkins, cpe:/a:cloudbees:jenkins

Required KB Items: installed_sw/Jenkins

Exploit Ease: No known exploits are available

Patch Publication Date: 4/2/2025

Vulnerability Publication Date: 4/2/2025

Reference Information

CVE: CVE-2025-31722, CVE-2025-31723, CVE-2025-31724, CVE-2025-31725, CVE-2025-31726, CVE-2025-31727, CVE-2025-31728