Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.
Scores
Version
Score
Vecteur
Évalué par
CVSS 3.1
CRITICAL 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD · nvd@nist.gov (Primary)
CVSS 2.0
MEDIUM 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:N
NVD · nvd@nist.gov (Primary)
Avis
GHSA-cv2w-q8c3-xjv7 — Agent-to-controller access control allows reading/writing most content of build directories in Jenkins
