What it is about

Jenkins ist ein erweiterbarer, webbasierter Integration Server zur kontinuierlichen Unterstützung bei Softwareentwicklungen aller Art. Ein Angreifer kann mehrere Schwachstellen in Jenkins Plugins ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen zu manipulieren oder offenzulegen.

Under what conditions?

The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.

What can happen in the worst case

An attacker could use the vulnerability to

• beliebigen Programmcode auszuführen
• Sicherheitsmaßnahmen zu umgehen
• vertrauliche Informationen zu manipulieren oder offenzulegen

Am I affected?

Affected according to the BSI:

• Jenkins Jenkins Active Directory Plugin <2.41.2
• Jenkins Jenkins Bitbucket Push and Pull Request Plugin <3.3.9
• Jenkins Jenkins Contrast Continuous Application Security Plugin <3.12
• Jenkins Jenkins EC2 Fleet Plugin <4.2.3.540.va_6eedb_7b_c112
• Jenkins Jenkins External Workspace Manager Plugin <1.4.0
• Jenkins Jenkins Git client Plugin <6.6.1
• Jenkins Jenkins Git Parameter Plugin <462.463.v496a_59f698e5
• Jenkins Jenkins Gitee Plugin <1292.v2559f2f3f2c0
• Jenkins Jenkins GitHub Branch Source Plugin <1967.1970.vd86979736546
• Jenkins Jenkins Job Configuration History Plugin <1367.vc8fa_b_15101dc
• Jenkins Jenkins MCP Server Plugin <0.178.vffe5a_e770f3b_
• Jenkins Jenkins Pipeline: Groovy Plugin <4331.4333.v50a_b_076c5199

and 7 more

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• Jenkins Jenkins Active Directory Plugin 2.41.2
• Jenkins Jenkins Bitbucket Push and Pull Request Plugin 3.3.9
• Jenkins Jenkins Contrast Continuous Application Security Plugin 3.12
• Jenkins Jenkins EC2 Fleet Plugin 4.2.3.540.va_6eedb_7b_c112
• Jenkins Jenkins External Workspace Manager Plugin 1.4.0
• Jenkins Jenkins Git client Plugin 6.6.1
• Jenkins Jenkins Git Parameter Plugin 462.463.v496a_59f698e5
• Jenkins Jenkins Gitee Plugin 1292.v2559f2f3f2c0
• Jenkins Jenkins GitHub Branch Source Plugin 1967.1970.vd86979736546
• Jenkins Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc
• Jenkins Jenkins MCP Server Plugin 0.178.vffe5a_e770f3b_
• Jenkins Jenkins Pipeline: Groovy Plugin 4331.4333.v50a_b_076c5199

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.