Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.
Scores
Version
Score
Vector
Scored by
CVSS 3.1
CRITICAL 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD · nvd@nist.gov (Primary)
CVSS 2.0
MEDIUM 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:N
NVD · nvd@nist.gov (Primary)
Advisories
GHSA-cv2w-q8c3-xjv7 — Agent-to-controller access control allows reading/writing most content of build directories in Jenkins
