Jenkins : Script Security Support in Plugins

This page lists Jenkins plugins that implement scripting related features, and the state of their integration with the Script Security plugin (if needed). While it's possible for plugins to be safe to use without integrating with Script Security (e.g. only enable scripting features when Jenkins security is disabled, or limit features properly to users with Run Scripts permission), integrating Script Security is a common, proven approach.

For each listed plugin, the following information is tracked:

• The state of the vulnerability in the current release:
  • Never indicates the plugin has not been found to be affected by a major scripting related vulnerability, despite offering scripting related features, or has been integrated with Script Security plugin from the start.
  • Fixed indicates that the plugin used to have a scripting-related vulnerability, that has been fixed and released (typically by integrating with Script Security).
  • Admin Only indicates that the plugin does not distinguish properly between Administer and Run Scripts permission, which is only relevant in specific situations, like hosted Jenkins environments. While this is, strictly speaking, a vulnerability, most Jenkins administrators will not be affected.
  • Yes indicates that current releases of this plugin are considered to be affected by a known, public scripting related security vulnerability.

More information:

• 2017-04-10 Security Advisory publishing several scripting-related security vulnerabilities
• Announcement blog post to security advisory above
• https://github.com/jenkins-infra/backend-update-center2 is the update center generator, containing the data over which plugins had their distribution suspended due to a vulnerability, and for which plugins warnings have been issued.
• Script Security plugin on the Jenkins Plugins Index