Stored Cross-Site Scripting Vulnerability in Jenkins Shelve Project Plugin
Summary
CVE-2018-1999029: Stored Cross-Site Scripting Vulnerability in Jenkins Shelve Project Plugin. Affects org.jenkins-ci.plugins:shelve-project-plugin versions < 2.0. Fixed in 2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Shelve Project Plugin is a Maven ecosystem package that provides functionality for shelving projects in Jenkins. It allows users with Job/Configure permission to temporarily archive a project and restore it later. This plugin is widely used in Jenkins installations for project management and version control.
Vulnerability Detail
A stored cross-site scripting (XSS) vulnerability has been identified in Jenkins Shelve Project Plugin version 1.5 and earlier. The vulnerability exists in the ShelveProjectAction/index.jelly and ShelvedProjectsAction/index.jelly files. Attackers with Job/Configure permission can exploit this vulnerability by injecting malicious JavaScript code, which will be executed in another user's browser when that user performs certain actions in the user interface. This can lead to unauthorized access, data theft, and potential manipulation of the affected user's account.
How To Fix
Minimum fixed version
2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict Job/Configure permission to trusted individuals only. By limiting access to this permission, the risk of exploitation can be reduced. However, this workaround may not be feasible in environments where multiple users require Job/Configure permission for legitimate purposes. Therefore, upgrading to the latest version of the plugin is the recommended long-term solution.
Conclusion
The stored cross-site scripting vulnerability in Jenkins Shelve Project Plugin can be mitigated by upgrading to version 2.0 or later. It is crucial to promptly apply security patches and keep all installed plugins up to date to ensure the overall security of the Jenkins installation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:shelve-project-plugin →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript code in another user's browser, potentially leading to unauthorized access, data theft, and account manipulation.
Attackers with Job/Configure permission in Jenkins can exploit this vulnerability.
Upgrading to Jenkins Shelve Project Plugin version 2.0 or later is the recommended mitigation for this vulnerability.
A temporary workaround is to restrict Job/Configure permission to trusted individuals only. However, this may not be feasible in certain environments.
Users can update the plugin by following the standard plugin update process in Jenkins.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:shelve-project-plugin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
