Jenkins Security Advisory 2013-02-16

One of the vulnerabilities allows cross-site request forgery (CSRF) attacks on the Jenkins controller, which causes an user to make unwanted actions on Jenkins.

Another vulnerability enables cross-site scripting (XSS) attacks, which has the similar consequence.

Another vulnerability allowed an attacker to bypass the CSRF protection mechanism in place, thereby mounting more CSRF attackes. These attacks allow an attacker without direct access to Jenkins to mount an attack.

In the fourth vulnerability, a malicious user of Jenkins can trick Jenkins into building jobs that he does not have direct access to.

And lastly, a vulnerability allows a malicious user of Jenkins to mount a denial of service attack by feeding a carefully crafted payload to Jenkins.

The first three vulnerabilities (CSRF and XSS) are rated as high, as they allow malicious users to gain unauthorized access to the information and impersonate the administrator of the system. In addition, this allows Jenkins inside a firewall to be attacked from outside. On the other hands, this attack can be only mounted passively, and the attacker needs to know the URL of your Jenkins installations.

The build privilege escalation vulnerability is rated as medium, as it requires an attacker to be a valid user of Jenkins with a write access.

The last denial of service attack is rated low, as it also requires an attacker to be a valid user of Jenkins with a write access, and this does not result in any data loss nor privilege escalation.

All the prior versions are affected by these vulnerabilities.

As a part of the fix, these versions contain the following incompatible changes. Administrators of Jenkins need to be aware of the following implications of the upgrade: