GitHub Advisoryadvisory · Maven

GHSA-qv6q-4jwx-7j5c Arbitrary file write vulnerability in Jenkins Storable Configs Plugin

MEDIUM Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2020-2278
Ecosystem
Maven
Packages
org.jvnet.hudson.plugins:storable-configs-plugin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2022-12-28

Affected packages

• Maven org.jvnet.hudson.plugins:storable-configs-plugin: <= 1.0 (no fix yet)

Description

Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any other '.xml' file on the Jenkins controller with a job config.xml file's content.

Related

Alias · CVE (1)

  • CVE-2020-2278 Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References