Jenkins vulnerabilities

A vulnerability in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline characters between `//`, allowing attackers to perform phishing attacks.

Jenkins versions 2.567 and earlier, LTS 2.555.2 and earlier improperly determine that a redirect URL after login legitimately points to Jenkins when it contains relative path segments (`./` or `../`), allowing attackers to perform phishing attacks.

A vulnerability in Jenkins 2.554 and earlier, and LTS 2.541.2 and earlier, allows unsafe handling of symbolic links during extraction of .tar and .tar.gz archives. This can enable writing files to arbitrary filesystem locations, restricted only by Jenkins user permissions.

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the attacker's account.

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Jenkins 2.540 and earlier, and LTS 2.528.2 and earlier, store build authorization tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Jenkins 2.540 and earlier, and LTS 2.528.2 and earlier, lack a permission check that allows attackers with View/Read permission to view encrypted password values in views.

Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.

Jenkins versions 2.415 and earlier, and LTS 2.401.2 and earlier do not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored XSS vulnerability exploitable by attackers able to control build log contents.

In Jenkins versions 2.399 and earlier, and LTS 2.387.3 and earlier, POST requests are sent to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint by opening a context menu.