Jenkins Security Advisory 2023-06-14

{
  "id": "270195734eb832647d6a3b577c18929a3ee45b2b5c834503f00049de023c5b97",
  "url": "https://www.jenkins.io/security/advisory/2023-06-14/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2023-06-14",
    "summary": "The advisory reports vulnerabilities across Jenkins core and several plugins. Fixed releases are available for Jenkins, Checkmarx Plugin, Dimensions Plugin, and Team Concert Plugin; the remaining listed plugin issues had no fixes available at publication.",
    "evidence": "These versions include fixes to the vulnerabilities described above.",
    "products": [
      {
        "name": {
          "value": "Jenkins (core)",
          "evidence": "Jenkins (core)"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.400",
            "evidence": "Jenkins weekly should be updated to version 2.400"
          },
          {
            "value": "2.401.1",
            "evidence": "Jenkins LTS should be updated to version 2.401.1"
          }
        ],
        "affected_versions": [
          {
            "value": "weekly up to and including 2.399",
            "evidence": "Jenkins weekly up to and including 2.399"
          },
          {
            "value": "LTS up to and including 2.387.3",
            "evidence": "Jenkins LTS up to and including 2.387.3"
          }
        ]
      },
      {
        "name": {
          "value": "AWS CodeCommit Trigger Plugin",
          "evidence": "AWS CodeCommit Trigger Plugin"
        },
        "prerequisites": [
          {
            "value": "Item/Read permission",
            "evidence": "allowing attackers with Item/Read permission to obtain the contents of arbitrary files"
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 3.0.12",
            "evidence": "AWS CodeCommit Trigger Plugin up to and including 3.0.12"
          }
        ]
      },
      {
        "name": {
          "value": "Checkmarx Plugin",
          "evidence": "Checkmarx Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2023.2.6",
            "evidence": "Checkmarx Plugin should be updated to version 2023.2.6"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2022.4.3",
            "evidence": "Checkmarx Plugin up to and including 2022.4.3"
          }
        ]
      },
      {
        "name": {
          "value": "Digital.ai App Management Publisher Plugin",
          "evidence": "Digital.ai App Management Publisher Plugin"
        },
        "prerequisites": [
          {
            "value": "Overall/Read permission",
            "evidence": "This allows attackers with Overall/Read permission to connect to an attacker-specified URL"
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 2.6",
            "evidence": "Digital.ai App Management Publisher Plugin up to and including 2.6"
          }
        ]
      },
      {
        "name": {
          "value": "Dimensions Plugin",
          "evidence": "Dimensions Plugin"
        },
        "prerequisites": [
          {
            "value": "Overall/Read permission",
            "evidence": "This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins."
          },
          {
            "value": "Item/Configure permission",
            "evidence": "This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to."
          }
        ],
        "fixed_versions": [
          {
            "value": "0.9.3.1",
            "evidence": "Dimensions Plugin should be updated to version 0.9.3.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 0.9.3",
            "evidence": "Dimensions Plugin up to and including 0.9.3"
          }
        ]
      },
      {
        "name": {
          "value": "Maven Repository Server Plugin",
          "evidence": "Maven Repository Server Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.10",
            "evidence": "Maven Repository Server Plugin up to and including 1.10"
          }
        ]
      },
      {
        "name": {
          "value": "Sonargraph Integration Plugin",
          "evidence": "Sonargraph Integration Plugin"
        },
        "prerequisites": [
          {
            "value": "Item/Configure permission",
            "evidence": "stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission."
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 5.0.1",
            "evidence": "Sonargraph Integration Plugin up to and including 5.0.1"
          }
        ]
      },
      {
        "name": {
          "value": "Team Concert Plugin",
          "evidence": "Team Concert Plugin"
        },
        "prerequisites": [
          {
            "value": "Overall/Read permission",
            "evidence": "This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path"
          }
        ],
        "fixed_versions": [
          {
            "value": "2.4.2",
            "evidence": "Team Concert Plugin should be updated to version 2.4.2"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 2.4.1",
            "evidence": "Team Concert Plugin up to and including 2.4.1"
          }
        ]
      },
      {
        "name": {
          "value": "Template Workflows Plugin",
          "evidence": "Template Workflows Plugin"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 41.v32d86a_313b_4a",
            "evidence": "Template Workflows Plugin up to and including 41.v32d86a_313b_4a"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2023-35141",
        "evidence": "SECURITY-3135 / CVE-2023-35141"
      },
      {
        "value": "CVE-2023-35142",
        "evidence": "SECURITY-2870 / CVE-2023-35142"
      },
      {
        "value": "CVE-2023-3315",
        "evidence": "SECURITY-2932 / CVE-2023-3315"
      },
      {
        "value": "CVE-2023-32261",
        "evidence": "SECURITY-3138 / CVE-2023-32261"
      },
      {
        "value": "CVE-2023-32262",
        "evidence": "SECURITY-3143 / CVE-2023-32262"
      },
      {
        "value": "CVE-2023-35143",
        "evidence": "SECURITY-3156 / CVE-2023-35143"
      },
      {
        "value": "CVE-2023-35144",
        "evidence": "SECURITY-2951 / CVE-2023-35144"
      },
      {
        "value": "CVE-2023-35145",
        "evidence": "SECURITY-3155 / CVE-2023-35145"
      },
      {
        "value": "CVE-2023-35146",
        "evidence": "SECURITY-3166 / CVE-2023-35146"
      },
      {
        "value": "CVE-2023-35147",
        "evidence": "SECURITY-3099 / CVE-2023-35147"
      },
      {
        "value": "CVE-2023-35148",
        "evidence": "CVE-2023-35148 (CSRF)"
      },
      {
        "value": "CVE-2023-35149",
        "evidence": "CVE-2023-35149 (missing permission check)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23938,
  "published_at": "2023-06-14T12:00:00+00:00"
}