FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

jenkins -- multiple vulnerabilities

Affected packages
jenkins <= 1.641
jenkins-lts <= 1.625.3


VuXML ID 23af0425-9eac-11e5-b937-00e0814cab4e
Discovery 2015-12-09
Entry 2015-12-09

Jenkins Security Advisory:


SECURITY-95 / CVE-2015-7536 (Stored XSS vulnerability through workspace files and archived artifacts)

In certain configurations, low privilege users were able to create e.g. HTML files in workspaces and archived artifacts that could result in XSS when accessed by other users. Jenkins now sends Content-Security-Policy headers that enables sandboxing and prohibits script execution by default.

SECURITY-225 / CVE-2015-7537 (CSRF vulnerability in some administrative actions)

Several administration/configuration related URLs could be accessed using GET, which allowed attackers to circumvent CSRF protection.

SECURITY-233 / CVE-2015-7538 (CSRF protection ineffective)

Malicious users were able to circumvent CSRF protection on any URL by sending specially crafted POST requests.

SECURITY-234 / CVE-2015-7539 (Jenkins plugin manager vulnerable to MITM attacks)

While the Jenkins update site data is digitally signed, and the signature verified by Jenkins, Jenkins did not verify the provided SHA-1 checksums for the plugin files referenced in the update site data. This enabled MITM attacks on the plugin manager, resulting in installation of attacker-provided plugins.