Jenkins Security Advisory 2023-12-13

{
  "id": "bd12027f32497ce46df8afa4b81c87e1b8ac6aba0a0332972d4e2d7fdd7bdc7a",
  "url": "https://www.jenkins.io/security/advisory/2023-12-13/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Jenkins Security Advisory 2023-12-13",
    "summary": "The Jenkins advisory reports vulnerabilities across several plugins. Fixes are available for Analysis Model API, Nexus Platform, and Scriptler; no fixes were available at publication for the other listed plugins.",
    "evidence": "These versions include fixes to the vulnerabilities described above.",
    "products": [
      {
        "name": {
          "value": "Analysis Model API Plugin",
          "evidence": "Analysis Model API Plugin should be updated to version 11.13.0"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "11.13.0",
            "evidence": "Analysis Model API Plugin should be updated to version 11.13.0"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 11.11.0",
            "evidence": "Analysis Model API Plugin up to and including 11.11.0"
          }
        ]
      },
      {
        "name": {
          "value": "Nexus Platform Plugin",
          "evidence": "Nexus Platform Plugin should be updated to version 3.18.1-01"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.18.1-01",
            "evidence": "Nexus Platform Plugin should be updated to version 3.18.1-01"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 3.18.0-03",
            "evidence": "Nexus Platform Plugin up to and including 3.18.0-03"
          }
        ]
      },
      {
        "name": {
          "value": "Scriptler Plugin",
          "evidence": "Scriptler Plugin should be updated to version 344.v5a_ddb_5f9e685"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "344.v5a_ddb_5f9e685",
            "evidence": "Scriptler Plugin should be updated to version 344.v5a_ddb_5f9e685"
          }
        ],
        "affected_versions": [
          {
            "value": "up to and including 342.v6a_89fd40f466",
            "evidence": "Scriptler Plugin up to and including 342.v6a_89fd40f466"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2023-5072",
        "evidence": "SECURITY-3327 / CVE-2023-5072"
      },
      {
        "value": "CVE-2023-50764",
        "evidence": "SECURITY-3205 / CVE-2023-50764"
      },
      {
        "value": "CVE-2023-50765",
        "evidence": "SECURITY-3206 / CVE-2023-50765"
      },
      {
        "value": "CVE-2023-50766",
        "evidence": "CVE-2023-50766 (CSRF)"
      },
      {
        "value": "CVE-2023-50767",
        "evidence": "CVE-2023-50767 (missing permission check)"
      },
      {
        "value": "CVE-2023-50768",
        "evidence": "CVE-2023-50768 (CSRF)"
      },
      {
        "value": "CVE-2023-50769",
        "evidence": "CVE-2023-50769 (missing permission check)"
      },
      {
        "value": "CVE-2023-50770",
        "evidence": "SECURITY-3168 / CVE-2023-50770"
      },
      {
        "value": "CVE-2023-50771",
        "evidence": "SECURITY-2979 / CVE-2023-50771"
      },
      {
        "value": "CVE-2023-50772",
        "evidence": "CVE-2023-50772 (storage)"
      },
      {
        "value": "CVE-2023-50773",
        "evidence": "CVE-2023-50773 (masking)"
      },
      {
        "value": "CVE-2023-50774",
        "evidence": "SECURITY-3183 / CVE-2023-50774"
      },
      {
        "value": "CVE-2023-50775",
        "evidence": "SECURITY-3092 / CVE-2023-50775"
      },
      {
        "value": "CVE-2023-50776",
        "evidence": "CVE-2023-50776 (storage)"
      },
      {
        "value": "CVE-2023-50777",
        "evidence": "CVE-2023-50777 (masking)"
      },
      {
        "value": "CVE-2023-50778",
        "evidence": "CVE-2023-50778 (CSRF)"
      },
      {
        "value": "CVE-2023-50779",
        "evidence": "CVE-2023-50779 (missing permission check)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-jenkins-security-advisories",
  "document_id": 23927,
  "published_at": "2023-12-13T12:00:00+00:00"
}