Check if a Jenkins plugin or its dependencies are vulnerable

check_vulnerable_plugins.groovy

def static isPluginVulnerable(name) {
  
  def plugins = [:]
  
  // Push all plugins from all update site
  jenkins.model.Jenkins.instance.updateCenter.sites.each {plugins += it.data.plugins}
  
  def plugin = plugins[name]
  
  // Ignore
  if (!plugin) {
    println("Plugin '${name}' doesn't exists. Nothing to do.")
    return false
  }
  
  // Any warning
  if (plugin.warnings) {
    return true
  }
  
  // Let's be recursive, we should not have any circular dependencies
  def vulnerable = false
  plugin.dependencies.each { dependencyName, dependencyVersion ->
    if (isPluginVulnerable(dependencyName)) {
      vulnerable = true
    }
  }
  
  return vulnerable
}


// Examples
println isPluginVulnerable('git')
println isPluginVulnerable('envinject')
println isPluginVulnerable('jenkins-multijob-plugin')