A deprecated Jenkins plugin is used on a Jenkins Instance

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_349
Category - Subcategory	Pipeline Configuration - 3rd Party Services
Severity	CRITICAL

Impact

A deprecated Jenkins plugin is used in a Jenkins Instance. When a plugin is deprecated, it is often because the maintainer has stopped updating it. If a new security flaw is discovered in the plugin, there will be no official patch to fix it. Moreover, hackers specifically look for known vulnerabilities in older software versions. A single deprecated plugin can serve as an entry point for an attacker to gain control over your entire CI/CD pipeline.