Jenkins Security Advisory 2023-10-25

{
  "id": "5539de34c009c24cd3d6a9c74fe13c871450f415d2f1b180ea8f2c771cf1200e",
  "url": "https://www.jenkins.io/security/advisory/2023-10-25/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2023-10-25",
    "summary": "The advisory describes vulnerabilities in Jenkins plugins. Fixed versions are available for CloudBees CD, GitHub, lambdatest-automation, and Warnings plugins. It reports no fixes available at publication for Edgewall Trac, Gogs, MSTeams Webhook Trigger, Multibranch Scan Webhook Trigger, and Zanata plugins.",
    "evidence": "These versions include fixes to the vulnerabilities described above.",
    "products": [
      {
        "name": {
          "value": "CloudBees CD Plugin",
          "evidence": "CloudBees CD Plugin should be updated to version 1.1.33"
        },
        "prerequisites": [
          {
            "value": "able to configure jobs",
            "evidence": "This allows attackers able to configure jobs to delete arbitrary files on the Jenkins controller file system."
          }
        ],
        "fixed_versions": [
          {
            "value": "1.1.33",
            "evidence": "CloudBees CD Plugin should be updated to version 1.1.33"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.1.32",
            "evidence": "CloudBees CD Plugin up to and including 1.1.32"
          }
        ]
      },
      {
        "name": {
          "value": "GitHub Plugin",
          "evidence": "GitHub Plugin should be updated to version 1.37.3.1"
        },
        "prerequisites": [
          {
            "value": "Item/Configure permission",
            "evidence": "exploitable by attackers with Item/Configure permission."
          }
        ],
        "fixed_versions": [
          {
            "value": "1.37.3.1",
            "evidence": "GitHub Plugin should be updated to version 1.37.3.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.37.3",
            "evidence": "GitHub Plugin up to and including 1.37.3"
          }
        ]
      },
      {
        "name": {
          "value": "lambdatest-automation Plugin",
          "evidence": "lambdatest-automation Plugin should be updated to version 1.20.10"
        },
        "prerequisites": [
          {
            "value": "Overall/Read permission",
            "evidence": "This allows attackers with Overall/Read permission to enumerate credentials IDs"
          }
        ],
        "fixed_versions": [
          {
            "value": "1.20.10",
            "evidence": "lambdatest-automation Plugin should be updated to version 1.20.10"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.20.9",
            "evidence": "lambdatest-automation Plugin up to and including 1.20.9"
          }
        ]
      },
      {
        "name": {
          "value": "lambdatest-automation Plugin",
          "evidence": "lambdatest-automation Plugin should be updated to version 1.21.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.21.0",
            "evidence": "lambdatest-automation Plugin should be updated to version 1.21.0"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 1.20.10",
            "evidence": "lambdatest-automation Plugin up to and including 1.20.10"
          }
        ]
      },
      {
        "name": {
          "value": "Warnings Plugin",
          "evidence": "Warnings Plugin should be updated to version 10.5.1"
        },
        "prerequisites": [
          {
            "value": "Item/Configure permission",
            "evidence": "This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to."
          }
        ],
        "fixed_versions": [
          {
            "value": "10.5.1",
            "evidence": "Warnings Plugin should be updated to version 10.5.1"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 10.5.0",
            "evidence": "Warnings Plugin up to and including 10.5.0"
          }
        ]
      },
      {
        "name": {
          "value": "Edgewall Trac Plugin",
          "evidence": "Edgewall Trac Plugin up to and including 1.13"
        },
        "prerequisites": [
          {
            "value": "Item/Configure permission",
            "evidence": "exploitable by attackers with Item/Configure permission."
          }
        ],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.13",
            "evidence": "Edgewall Trac Plugin up to and including 1.13"
          }
        ]
      },
      {
        "name": {
          "value": "Gogs Plugin",
          "evidence": "Gogs Plugin up to and including 1.0.15"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.0.15",
            "evidence": "Gogs Plugin up to and including 1.0.15"
          }
        ]
      },
      {
        "name": {
          "value": "MSTeams Webhook Trigger Plugin",
          "evidence": "MSTeams Webhook Trigger Plugin up to and including 0.1.1"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 0.1.1",
            "evidence": "MSTeams Webhook Trigger Plugin up to and including 0.1.1"
          }
        ]
      },
      {
        "name": {
          "value": "Multibranch Scan Webhook Trigger Plugin",
          "evidence": "Multibranch Scan Webhook Trigger Plugin up to and including 1.0.9"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 1.0.9",
            "evidence": "Multibranch Scan Webhook Trigger Plugin up to and including 1.0.9"
          }
        ]
      },
      {
        "name": {
          "value": "Zanata Plugin",
          "evidence": "Zanata Plugin up to and including 0.6"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "up to and including 0.6",
            "evidence": "Zanata Plugin up to and including 0.6"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2023-46650",
        "evidence": "SECURITY-3246 / CVE-2023-46650"
      },
      {
        "value": "CVE-2023-46651",
        "evidence": "SECURITY-3265 / CVE-2023-46651"
      },
      {
        "value": "CVE-2023-46652",
        "evidence": "SECURITY-3222 / CVE-2023-46652"
      },
      {
        "value": "CVE-2023-46653",
        "evidence": "SECURITY-3202 / CVE-2023-46653"
      },
      {
        "value": "CVE-2023-46654",
        "evidence": "SECURITY-3237 / CVE-2023-46654"
      },
      {
        "value": "CVE-2023-46655",
        "evidence": "SECURITY-3238 / CVE-2023-46655"
      },
      {
        "value": "CVE-2023-46656",
        "evidence": "SECURITY-2875 / CVE-2023-46656"
      },
      {
        "value": "CVE-2023-46657",
        "evidence": "SECURITY-2896 / CVE-2023-46657"
      },
      {
        "value": "CVE-2023-46658",
        "evidence": "SECURITY-2876 / CVE-2023-46658"
      },
      {
        "value": "CVE-2023-46659",
        "evidence": "SECURITY-3247 / CVE-2023-46659"
      },
      {
        "value": "CVE-2023-46660",
        "evidence": "SECURITY-2879 / CVE-2023-46660"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23929,
  "published_at": "2023-10-25T12:00:00+00:00"
}