GitHub Advisoryadvisory · Maven

GHSA-x646-m7x2-gcp7 Path Traversal in Jenkins

HIGH Published 2022-05-13 Modified 2022-06-30 Official page ↗
Aliases
CVE-2018-1000194
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-22
Reviewed
2022-06-30

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.107.3 → fixed in 2.107.3 • Maven org.jenkins-ci.main:jenkins-core: >= 2.108, < 2.121 → fixed in 2.121

Description

A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.

Related

Alias · CVE (1)

  • CVE-2018-1000194 A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References