Skip to content
OpenAdvisories
Medium · 6.5 CVE-2020-2293 EUVD-2022-2618GHSA-5mfw-p6qv-wgvv

Arbitrary file read vulnerability in Jenkins Persona Plugin

Published Oct 8, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Persona Plugin Package: org.jenkins-ci.plugins:persona Category: Web / CMS Ecosystem: Maven

Description

Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Persona Plugin unspecified – ≤ 2.4 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:persona <= 2.4 — GHSA-5mfw-p6qv-wgvv

References