Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Bumblebee HP ALM Plugin
*   Cadence vManager Plugin
*   CRX Content Package Deployer Plugin
*   Delphix Plugin
*   ElasticBox CI Plugin
*   Extensive Testing Plugin
*   Fortify on Demand Plugin
*   Google Kubernetes Engine Plugin
*   Google OAuth Credentials Plugin
*   iceScrum Plugin
*   NeoLoad Plugin
*   Oracle Cloud Infrastructure Compute Classic Plugin
*   Puppet Enterprise Pipeline Plugin
*   Rundeck Plugin
*   SOASTA CloudTest Plugin
*   Sofy.AI Plugin
*   View26 Test-Reporting Plugin

**Descriptions****Arbitrary file read vulnerability in Google OAuth Credentials Plugin**

**SECURITY-1583 / CVE-2019-10436**  
**Severity (CVSS):** Medium  
**Affected plugin: google-oauth-plugin**  
**Description:**

Google OAuth Credentials Plugin allowed the creation of credentials based on the content of files on the Jenkins controller through a feature retaining backwards compatibility with earlier plugin releases. This allowed users with the permission to configure jobs and credentials to read arbitrary files on the Jenkins controller by creating a credential referencing an arbitrary file on the Jenkins controller.

Google OAuth Credentials Plugin no longer allows a regular user to create credentials in the legacy format.

**CSRF vulnerability and missing permission check in CRX Content Package Deployer Plugin allowed capturing credentials**

**SECURITY-1006 (1) / CVE-2019-10437 (CSRF), CVE-2019-10438 (permission check)**  
**Severity (CVSS):** High  
**Affected plugin: crx-content-package-deployer**  
**Description:**

CRX Content Package Deployer Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, the form validation method did not require POST requests, resulting in a CSRF vulnerability.

CRX Content Package Deployer Plugin now requires POST requests and Item/Configure permission.

**Users with Overall/Read access could enumerate credential IDs in CRX Content Package Deployer Plugin**

**SECURITY-1006 (2) / CVE-2019-10439**  
**Severity (CVSS):** Medium  
**Affected plugin: crx-content-package-deployer**  
**Description:**

CRX Content Package Deployer Plugin provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use.

This functionality did not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in CRX Content Package Deployer Plugin now requires the appropriate permission.

**NeoLoad Plugin stored credentials in plain text**

**SECURITY-1427 / CVE-2019-10440**  
**Severity (CVSS):** Medium  
**Affected plugin: neoload-jenkins-plugin**  
**Description:**

NeoLoad Plugin stored credentials unencrypted in its global configuration file org.jenkinsci.plugins.neoload.integration.NeoGlobalConfig.xml and in job config.xml files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission or access to the Jenkins controller file system.

NeoLoad Plugin now stores these credentials encrypted.

**CSRF vulnerability and missing permission check in iceScrum Plugin**

**SECURITY-1484 / CVE-2019-10441 (CSRF), CVE-2019-10442 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: icescrum**  
**Description:**

iceScrum Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified access token or username and password.

Additionally, the form validation method did not require POST requests, resulting in a CSRF vulnerability.

iceScrum Plugin now requires POST requests and Overall/Administer permission.

**iceScrum Plugin stored credentials in plain text**

**SECURITY-1436 / CVE-2019-10443**  
**Severity (CVSS):** Medium  
**Affected plugin: icescrum**  
**Description:**

iceScrum Plugin stored credentials unencrypted in job config.xml files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission or access to the Jenkins controller file system.

iceScrum Plugin 1.1.5 and newer now stores these credentials encrypted.

**Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation**

**SECURITY-1481 / CVE-2019-10444**  
**Severity (CVSS):** Medium  
**Affected plugin: bumblebee**  
**Description:**

Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation for connections to the HP ALM service.

Bumblebee HP ALM Plugin no longer does that. Instead, it now allows users to opt out of certificate validation.

**Missing permission checks in Google Kubernetes Engine Plugin allowed validating and obtaining data**

**SECURITY-1607 / CVE-2019-10445**  
**Severity (CVSS):** Low  
**Affected plugin: google-kubernetes-engine**  
**Description:**

Missing permission checks in Google Kubernetes Engine Plugin allowed users with Overall/Read permission to obtain limited information about the scope and access of a credential with an attacker-specified credential ID obtained through another method.

Google Kubernetes Engine Plugin now requires Job/Configure permission for these operations.

**Cadence vManager Plugin globally and unconditionally disabled SSL/TLS certificate validation**

**SECURITY-1615 / CVE-2019-10446**  
**Severity (CVSS):** Medium  
**Affected plugin: vmanager-plugin**  
**Description:**

Cadence vManager Plugin unconditionally disabled SSL/TLS certificate validation for the entire Jenkins controller JVM.

Cadence vManager Plugin no longer does that. Instead, it now has an opt-in option to ignore SSL/TLS errors for its connections.

**Script sandbox bypass vulnerability in Puppet Enterprise Pipeline Plugin**

**SECURITY-918 / CVE-2019-10458**  
**Severity (CVSS):** High  
**Affected plugin: puppet-enterprise-pipeline**  
**Description:**

Puppet Enterprise Pipeline Plugin defines a custom list of pre-approved signatures for all scripts protected by the Script Security sandbox.

This custom list of pre-approved signatures allows the use of methods that can be used to bypass Script Security sandbox protection. This results in arbitrary code execution on any Jenkins instance with this plugin installed.

As of publication of this advisory there is no fix.

**Sofy.AI Plugin stores API token in plain text**

**SECURITY-1431 / CVE-2019-10447**  
**Severity (CVSS):** Medium  
**Affected plugin: sofy-ai**  
**Description:**

Sofy.AI Plugin stores an API token unencrypted in job config.xml files on the Jenkins controller. This token can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

**Extensive Testing Plugin stores credentials in plain text**

**SECURITY-1432 / CVE-2019-10448**  
**Severity (CVSS):** Medium  
**Affected plugin: extensivetesting**  
**Description:**

Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

**Fortify on Demand Plugin stores credentials in plain text**

**SECURITY-1433 / CVE-2019-10449**  
**Severity (CVSS):** Medium  
**Affected plugin: fortify-on-demand-uploader**  
**Description:**

Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

**ElasticBox CI Plugin stores access token in plain text**

**SECURITY-1434 / CVE-2019-10450**  
**Severity (CVSS):** Low  
**Affected plugin: elasticbox**  
**Description:**

ElasticBox CI Plugin stores an access token unencrypted in the global config.xml configuration file on the Jenkins controller. This token can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

**SOASTA CloudTest Plugin stores API token in plain text**

**SECURITY-1439 / CVE-2019-10451**  
**Severity (CVSS):** Medium  
**Affected plugin: cloudtest**  
**Description:**

SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file com.soasta.jenkins.CloudTestServer.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

**View26 Test-Reporting Plugin stores access token in plain text**

**SECURITY-1440 / CVE-2019-10452**  
**Severity (CVSS):** Medium  
**Affected plugin: view26**  
**Description:**

View26 Test-Reporting Plugin stores an access token unencrypted in job config.xml files on the Jenkins controller. This token can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

**Delphix Plugin stores credentials in plain text**

**SECURITY-1450 / CVE-2019-10453**  
**Severity (CVSS):** Low  
**Affected plugin: delphix**  
**Description:**

Delphix Plugin stores credentials unencrypted in its global configuration file io.jenkins.plugins.delphix.GlobalConfiguration.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory there is no fix.

**CSRF vulnerability and missing permission check in Rundeck Plugin**

**SECURITY-1460 / CVE-2019-10454 (CSRF), CVE-2019-10455 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: rundeck**  
**Description:**

Rundeck Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password.

Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability.

As of publication of this advisory there is no fix.

**CSRF vulnerability and missing permission check in Oracle Cloud Infrastructure Compute Classic Plugin**

**SECURITY-1462 / CVE-2019-10456 (CSRF), CVE-2019-10457 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: oracle-cloud-infrastructure-compute-classic**  
**Description:**

Oracle Cloud Infrastructure Compute Classic Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to initiate a connection test to an attacker-specified server with attacker-specified username and password.

Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability.

As of publication of this advisory there is no fix.

**Severity**

*   SECURITY-918: High
*   SECURITY-1006 (1): High
*   SECURITY-1006 (2): Medium
*   SECURITY-1427: Medium
*   SECURITY-1431: Medium
*   SECURITY-1432: Medium
*   SECURITY-1433: Medium
*   SECURITY-1434: Low
*   SECURITY-1436: Medium
*   SECURITY-1439: Medium
*   SECURITY-1440: Medium
*   SECURITY-1450: Low
*   SECURITY-1460: Medium
*   SECURITY-1462: Medium
*   SECURITY-1481: Medium
*   SECURITY-1484: Medium
*   SECURITY-1583: Medium
*   SECURITY-1607: Low
*   SECURITY-1615: Medium

**Affected Versions**

*   **Bumblebee HP ALM Plugin** up to and including 4.1.3
*   **Cadence vManager Plugin** up to and including 2.7.0
*   **CRX Content Package Deployer Plugin** up to and including 1.8.1
*   **Delphix Plugin** up to and including 2.0.4
*   **ElasticBox CI Plugin** up to and including 5.0.1
*   **Extensive Testing Plugin** up to and including 1.4.4b
*   **Fortify on Demand Plugin** up to and including 4.0.0
*   **Google Kubernetes Engine Plugin** up to and including 0.7.0
*   **Google OAuth Credentials Plugin** up to and including 0.9
*   **iceScrum Plugin** up to and including 1.1.5
*   **NeoLoad Plugin** up to and including 2.2.5
*   **Oracle Cloud Infrastructure Compute Classic Plugin** up to and including 1.0.0
*   **Puppet Enterprise Pipeline Plugin** up to and including 1.3.1
*   **Rundeck Plugin** up to and including 3.6.5
*   **SOASTA CloudTest Plugin** up to and including 2.25
*   **Sofy.AI Plugin** up to and including 1.0.3
*   **View26 Test-Reporting Plugin** up to and including 1.0.7

**Fix**

*   **Bumblebee HP ALM Plugin** should be updated to version 4.1.4
*   **Cadence vManager Plugin** should be updated to version 2.7.1
*   **CRX Content Package Deployer Plugin** should be updated to version 1.9
*   **Google Kubernetes Engine Plugin** should be updated to version 0.7.1
*   **Google OAuth Credentials Plugin** should be updated to version 0.10
*   **iceScrum Plugin** should be updated to version 1.1.6
*   **NeoLoad Plugin** should be updated to version 2.2.6

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Delphix Plugin
*   ElasticBox CI Plugin
*   Extensive Testing Plugin
*   Fortify on Demand Plugin
*   Oracle Cloud Infrastructure Compute Classic Plugin
*   Puppet Enterprise Pipeline Plugin
*   Rundeck Plugin
*   SOASTA CloudTest Plugin
*   Sofy.AI Plugin
*   View26 Test-Reporting Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-1615
*   **David Fiser of Trend Micro Nebula working with Trend Micro's Zero Day Initiative** for SECURITY-1427, SECURITY-1431, SECURITY-1432, SECURITY-1433, SECURITY-1434, SECURITY-1436, SECURITY-1439, SECURITY-1440, SECURITY-1450
*   **Jesse Glick, CloudBees, Inc.** for SECURITY-918
*   **Matt Sicker, CloudBees Inc.** for SECURITY-1607
*   **Oleg Nenashev, CloudBees, Inc.** for SECURITY-1006 (1), SECURITY-1006 (2)
*   **Viktor Gazdag NCC Group** for SECURITY-1460, SECURITY-1462, SECURITY-1481, SECURITY-1484
*   **Wadeck Follonier, Jesse Glick, and Daniel Beck, CloudBees, Inc.** for SECURITY-1583

CVE-2019-10443: Jenkins Security Advisory 2019-10-16

In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.

@@ -92,17 +92,27 @@ private function \_redirect() { }  
private function \_handleCallback(){ global $wgRequest;  
try { $storedState = $wgRequest\->getSession()->get('oauth2state'); // Enforce the \`state\` parameter to prevent clickjacking/CSRF if(isset($storedState) && $storedState != $\_GET\['state'\]) { if(isset($\_GET\['state'\])) { throw new UnexpectedValueException("State parameter of callback does not match original state"); } else { throw new UnexpectedValueException("Required state parameter missing"); } }  
// Try to get an access token using the authorization code grant. $accessToken = $this\->\_provider\->getAccessToken('authorization\_code', \[ 'code' => $\_GET\['code'\] \]); } catch (\\League\\OAuth2\\Client\\Provider\\Exception\\IdentityProviderException $e) {  
// Failed to get the access token or user details. exit($e\->getMessage()); // Failed to get the access token or user details. } catch (UnexpectedValueException $e) { exit($e\->getMessage());  
}  
$resourceOwner = $this\->\_provider\->getResourceOwner($accessToken);

CVE-2019-15150: Enforce/verify state parameter of callback · Schine/MW-OAuth2Client@6a4fe45

The events-manager plugin before 5.6 for WordPress has code injection.

CVE-2015-9298: Events Manager

A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersonate another user if they can control the pre-authentication session.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   Avatar Plugin
*   Build Pipeline Plugin
*   Codefresh Integration Plugin
*   Configuration as Code Plugin
*   eggplant-plugin Plugin
*   File System SCM Plugin
*   Google Cloud Messaging Notification Plugin
*   GitLab Authentication Plugin
*   JClouds Plugin
*   Mask Passwords Plugin
*   PegDown Formatter Plugin
*   Relution Enterprise Appstore Publisher Plugin
*   Simple Travis Pipeline Runner Plugin
*   TestLink Plugin
*   VMware Lab Manager Slaves Plugin
*   Wall Display Master Project Plugin
*   XL TestView Plugin

**Descriptions****Configuration as Code Plugin failed to mask secrets in system log messages**

**SECURITY-1497 / CVE-2019-10367**  
**Severity (CVSS):** Medium  
**Affected plugin: configuration-as-code**  
**Description:**

Configuration as Code Plugin logs the changes it applies to the Jenkins system log. Secrets such as passwords should be masked (i.e. replaced with asterisks) in that log to prevent accidental disclosure. Configuration as Code Plugin inspects the type and looks for a field, getter, or constructor argument corresponding to the property, making the secret detection much more robust for the purpose of log message masking. This was implemented in the fix for SECURITY-1279 in the 2019-07-31 security advisory.

That fix was incomplete and did not cover a log message written to the logger io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator.

Configuration as Code Plugin now uses the same secret detection for these log messages.

As a workaround, administrators can configure the logging level of the logger io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator to a level that does not include these messages. Configuration as Code Plugin 1.25 and earlier logs these messages at the INFO level, Configuration as Code Plugin 1.26 logs them at FINE. See the logging documentation for details.

**CSRF vulnerability and missing permission check in JClouds Plugin allowed capturing credentials**

**SECURITY-1482 / CVE-2019-10368 (CSRF), CVE-2019-10369 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: jclouds-jenkins**  
**Description:**

JClouds Plugin did not perform permission checks on a method implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method did not require POST requests, resulting in a cross-site request forgery vulnerability.

This form validation method now requires POST requests and Overall/Administer permission.

**Mask Passwords Plugin shows plain text passwords in global configuration form fields**

**SECURITY-157 / CVE-2019-10370**  
**Severity (CVSS):** Low  
**Affected plugin: mask-passwords**  
**Description:**

Mask Passwords Plugin allows specifying passwords to be provided to builds in the global Jenkins configuration.

While the passwords are stored encrypted on disk, they are transmitted in plain text as part of the configuration form. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.

As of publication of this advisory, there is no fix.

**HTTP session fixation vulnerability in GitLab Authentication Plugin**

**SECURITY-795 / CVE-2019-10371**  
**Severity (CVSS):** Medium  
**Affected plugin: gitlab-oauth**  
**Description:**

GitLab Authentication Plugin does not invalidate the previous session and create a new one upon successful login. This allows attackers able to control or obtain another user’s pre-login session ID to impersonate them.

As of publication of this advisory, there is no fix.

**Open redirect vulnerability in GitLab Authentication Plugin**

**SECURITY-796 / CVE-2019-10372**  
**Severity (CVSS):** Medium  
**Affected plugin: gitlab-oauth**  
**Description:**

GitLab Authentication Plugin records the HTTP Referer header when the authentication process starts and redirects users to that URL when the user has finished logging in.

This implements an open redirect, allowing malicious sites to implement a phishing attack, with users expecting they have just logged in to Jenkins.

As of publication of this advisory, there is no fix.

**Stored XSS vulnerability in Build Pipeline Plugin**

**SECURITY-879 / CVE-2019-10373**  
**Severity (CVSS):** Medium  
**Affected plugin: build-pipeline-plugin**  
**Description:**

Build Pipeline Plugin does not properly escape variables in views, resulting in a stored cross-site scripting vulnerability exploitable by users with permission to configure build pipelines.

As of publication of this advisory, there is no fix.

**Stored XSS vulnerability in PegDown Formatter Plugin**

**SECURITY-142 / CVE-2019-10374**  
**Severity (CVSS):** Medium  
**Affected plugin: pegdown-formatter**  
**Description:**

PegDown Formatter Plugin uses the PegDown library to implement support for rendering Markdown formatted descriptions in Jenkins. It advertises disabling of HTML to prevent cross-site scripting (XSS) as a feature.

PegDown Formatter Plugin does not prevent the use of javascript: scheme in URLs for links. This results in an XSS vulnerability exploitable by users able to configure entities with descriptions or similar properties that are rendered by the configured markup formatter.

As of publication of this advisory, there is no fix.

**Arbitrary file read vulnerability in File System SCM Plugin**

**SECURITY-569 / CVE-2019-10375**  
**Severity (CVSS):** Medium  
**Affected plugin: filesystem_scm**  
**Description:**

File System SCM Plugin allows users able to configure jobs to read arbitrary files from the Jenkins controller, even if the job is running on an agent.

As of publication of this advisory, there is no fix.

**Reflected XSS vulnerability in Wall Display Master Project Plugin**

**SECURITY-751 / CVE-2019-10376**  
**Severity (CVSS):** Medium  
**Affected plugin: jenkinswalldisplay**  
**Description:**

Wall Display Master Project Plugin does not properly escape the customTheme query parameter, resulting in a reflected cross-site scripting vulnerability.

As of publication of this advisory, there is no fix.

**Avatar Plugin allows changing other users' avatars**

**SECURITY-1099 / CVE-2019-10377**  
**Severity (CVSS):** Medium  
**Affected plugin: avatar**  
**Description:**

Avatar Plugin does not implement a permission check for the HTTP URL used to replace user avatars. This allows any user with Overall/Read permission to change any other user’s avatar, in addition to their own.

As of publication of this advisory, there is no fix.

**TestLink Plugin stores credentials in plain text**

**SECURITY-1428 / CVE-2019-10378**  
**Severity (CVSS):** Low  
**Affected plugin: testlink**  
**Description:**

TestLink Plugin stores credentials unencrypted in its global configuration file hudson.plugins.testlink.TestLinkBuilder.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

**Google Cloud Messaging Notification Plugin stores credentials in plain text**

**SECURITY-591 / CVE-2019-10379**  
**Severity (CVSS):** Low  
**Affected plugin: gcm-notification**  
**Description:**

Google Cloud Messaging Notification Plugin stores an API key unencrypted in its global configuration file org.jenkinsci.plugins.gcm.im.GcmPublisher.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

**Script sandbox bypass vulnerability in Simple Travis Pipeline Runner Plugin**

**SECURITY-922 / CVE-2019-10380**  
**Severity (CVSS):** High  
**Affected plugin: simple-travis-runner**  
**Description:**

Simple Travis Pipeline Runner Plugin defines a custom list of pre-approved signatures for scripts protected by the Script Security sandbox.

This custom list of pre-approved signatures allows the use of methods that can be used to bypass Script Security sandbox protection. This results in arbitrary code execution on any Jenkins instance with this plugin installed.

As of publication of this advisory, there is no fix.

**Codefresh Integration Plugin globally and unconditionally disables SSL/TLS certificate validation**

**SECURITY-931 / CVE-2019-10381**  
**Severity (CVSS):** Medium  
**Affected plugin: codefresh**  
**Description:**

Codefresh Integration Plugin unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM.

As of publication of this advisory, there is no fix.

**VMware Lab Manager Slaves Plugin globally and unconditionally disables SSL/TLS certificate validation**

**SECURITY-1376 / CVE-2019-10382**  
**Severity (CVSS):** Medium  
**Affected plugin: labmanager**  
**Description:**

VMware Lab Manager Slaves Plugin unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM.

As of publication of this advisory, there is no fix.

**eggplant-plugin Plugin stores credentials in plain text**

**SECURITY-1430 / CVE-2019-10385**  
**Severity (CVSS):** Medium  
**Affected plugin: eggplant-plugin**  
**Description:**

eggplant-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

**CSRF vulnerability and missing permission check in XL TestView Plugin allow capturing credentials**

**SECURITY-1008 / CVE-2019-10386 (CSRF), CVE-2019-10387 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: xltestview-plugin**  
**Description:**

XL TestView Plugin does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery vulnerability.

As of publication of this advisory, there is no fix.

**CSRF vulnerability and missing permission check in Relution Enterprise Appstore Publisher Plugin allow SSRF**

**SECURITY-1053 / CVE-2019-10388 (CSRF), CVE-2019-10389 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: relution-publisher**  
**Description:**

A missing permission check in a form validation method in Relution Enterprise Appstore Publisher Plugin allows users with Overall/Read permission to initiate a connection test to an attacker-specified URL using attacker-specified credentials and attacker-specified HTTP proxy configuration.

Additionally, the form validation method does not require POST requests, resulting in a CSRF vulnerability.

As of publication of this advisory, there is no fix.

**Severity**

*   SECURITY-142: Medium
*   SECURITY-157: Low
*   SECURITY-569: Medium
*   SECURITY-591: Low
*   SECURITY-751: Medium
*   SECURITY-795: Medium
*   SECURITY-796: Medium
*   SECURITY-879: Medium
*   SECURITY-922: High
*   SECURITY-931: Medium
*   SECURITY-1008: Medium
*   SECURITY-1053: Medium
*   SECURITY-1099: Medium
*   SECURITY-1376: Medium
*   SECURITY-1428: Low
*   SECURITY-1430: Medium
*   SECURITY-1482: Medium
*   SECURITY-1497: Medium

**Affected Versions**

*   **Avatar Plugin** up to and including 1.2
*   **Build Pipeline Plugin** up to and including 1.5.8
*   **Codefresh Integration Plugin** up to and including 1.8
*   **Configuration as Code Plugin** up to and including 1.26
*   **eggplant-plugin Plugin** up to and including 2.2
*   **File System SCM Plugin** up to and including 2.1
*   **Google Cloud Messaging Notification Plugin** up to and including 1.0
*   **GitLab Authentication Plugin** up to and including 1.4
*   **JClouds Plugin** up to and including 2.14
*   **Mask Passwords Plugin** up to and including 2.12.0
*   **PegDown Formatter Plugin** up to and including 1.3
*   **Relution Enterprise Appstore Publisher Plugin** up to and including 1.24
*   **Simple Travis Pipeline Runner Plugin** up to and including 1.0
*   **TestLink Plugin** up to and including 3.16
*   **VMware Lab Manager Slaves Plugin** up to and including 0.2.8
*   **Wall Display Master Project Plugin** up to and including 0.6.34
*   **XL TestView Plugin** up to and including 1.2.0

**Fix**

*   **Configuration as Code Plugin** should be updated to version 1.27
*   **JClouds Plugin** should be updated to version 2.15

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   Avatar Plugin
*   Build Pipeline Plugin
*   Codefresh Integration Plugin
*   eggplant-plugin Plugin
*   File System SCM Plugin
*   Google Cloud Messaging Notification Plugin
*   GitLab Authentication Plugin
*   Mask Passwords Plugin
*   PegDown Formatter Plugin
*   Relution Enterprise Appstore Publisher Plugin
*   Simple Travis Pipeline Runner Plugin
*   TestLink Plugin
*   VMware Lab Manager Slaves Plugin
*   Wall Display Master Project Plugin
*   XL TestView Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-879, SECURITY-931, SECURITY-1053, SECURITY-1376
*   **David Fiser of Trend Micro Nebula working with Trend Micro's Zero Day Initiative** for SECURITY-1428, SECURITY-1430
*   **Jesse Glick, CloudBees, Inc.** for SECURITY-922
*   **MWR labs (@mwrlabs)** for SECURITY-751
*   **Matthias Schmalz, SAP SE** for SECURITY-157
*   **Oleg Nenashev, CloudBees, Inc.** for SECURITY-1008, SECURITY-1099
*   **Oleg Nenashev, CloudBees, Inc., and, independently, Viktor Gazdag NCC Group** for SECURITY-1482
*   **Wadeck Follonier, CloudBees, Inc.** for SECURITY-795, SECURITY-796

CVE-2019-10371: Jenkins Security Advisory 2019-08-07

An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL outside Jenkins after successful login.

CVE-2019-10372: Jenkins Security Advisory 2019-08-07

A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI.

CVE-2019-10374: Jenkins Security Advisory 2019-08-07

A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipeline description to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.

CVE-2019-10373: Jenkins Security Advisory 2019-08-07

Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be hidden when logging the configuration being applied.

CVE-2019-10367: Jenkins Security Advisory 2019-08-07

A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.

CVE-2019-10376: Jenkins Security Advisory 2019-08-07

Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.

Tag

#oauth