Jenkins administrators can configure tools, such as JDK, Maven, or Ant, that will be available in job configurations for use by build scripts. Some tool names are not properly escaped on job configuration forms, resulting in a stored cross-site scripting vulnerability. Tools confirmed to be affected are: JDK (provided by Jenkins core) Ant (provided by Ant plugin) Others may also be affected by this. This vulnerability can only be exploited by Jenkins administrators, as they’re the only ones able to define tools. In the vast majority of Jenkins configurations, administrators are able to run any code and install any plugin. Therefore this vulnerability only really affects installations that don’t grant administrators the Run Scripts, Configure Update Sites, and Install Plugins permissions. The Jenkins project has prepared a plugin preventing the configuration of unsafe tool names at https://github.com/jenkinsci-cert/security624 as a workaround. External References: https://jenkins.io/security/advisory/2017-12-05/
Created jenkins tracking bugs for this issue: Affects: fedora-all [bug 1522903] Affects: openshift-1 [bug 1522904]