GitHub Advisoryadvisory · Maven

GHSA-89vc-7frq-2rfj Jenkins has Local File Inclusion Vulnerability

MEDIUM Published 2022-05-13 Modified 2025-03-13 Official page ↗
Aliases
CVE-2015-5322
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-22
Reviewed
2025-03-13

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.626, < 1.638 → fixed in 1.638 • Maven org.jenkins-ci.main:jenkins-core: < 1.625.2 → fixed in 1.625.2

Description

Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.

Related

Alias · CVE (1)

  • CVE-2015-5322 Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References