GitHub Advisoryadvisory · Maven

GHSA-fwxq-3f52-5cmc Jenkins Filesystem List Parameter Plugin has Path Traversal vulnerability

MEDIUM Published 2024-11-27 Modified 2024-11-27 Official page ↗
Aliases
CVE-2024-54004
Ecosystem
Maven
Packages
aendter.jenkins.plugins:filesystem-list-parameter-plugin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2024-11-27

Affected packages

• Maven aendter.jenkins.plugins:filesystem-list-parameter-plugin: < 0.0.15 → fixed in 0.0.15

Description

Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter. This allows attackers with Item/Configure permission to enumerate file names on the Jenkins controller file system. Filesystem List Parameter Plugin 0.0.15 ensures that paths used by the File system objects list Parameter are restricted to an allow list, with the default base directory set to $JENKINS_HOME/userContent/. The allow list can be configured to include additional custom base directories.

Related

Alias · CVE (1)

  • CVE-2024-54004 Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter,… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References