GHSA-x646-m7x2-gcp7
Path Traversal in Jenkins
At a glance
- Published
- Updated
- CVE
- CVE-2018-1000194
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Description
A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.jenkins-ci.main:jenkins-core | introduced 0, fixed 2.107.3 |
| Maven · org.jenkins-ci.main:jenkins-core | introduced 2.108, fixed 2.121 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000194 ADVISORY
- https://github.com/jenkinsci/jenkins/commit/5cf0a77d44310523b763698f67d645c1f2427f30 WEB
- https://github.com/jenkinsci/jenkins PACKAGE
- https://jenkins.io/security/advisory/2018-05-09/#SECURITY-788 WEB
- https://www.oracle.com/security-alerts/cpuapr2022.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |