Multiple Vulnerabilities in Jenkins

Affected Environment
Jenkins weekly up to 2.579, LTS up to 2.568.2, and numerous plugins including SAML, GitLab, and Performance.

Threat Overview
Multiple vulnerabilities enable remote code execution, privilege escalation, XSS, CSRF, and unauthorized configuration changes across plugins.

Exposure Timeline
Actively disclosed vulnerabilities; most plugins have fixes available, though the Parameterized Remote Trigger Plugin remains unpatched.

Attack Surface
Stapler form data binding, the REST API, config.xml submission, and multiple plugin configuration endpoints across Jenkins controllers.

Technical Root Cause
Unsafe deserialization, missing permission checks, and improper type restriction in Stapler binding across Jenkins core and plugins.

Exploitation Pathway
Attackers with Overall/Read permission submit crafted XML or forms to achieve RCE, privilege escalation, or data exposure.