Description
The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | unspecified – ≤ 2.314, unspecified – ≤ LTS 2.303.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.303.2 | 2.303.2 | GHSA-4pw5-r58h-fv24 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.304, < 2.315 | 2.315 | GHSA-4pw5-r58h-fv24 |
Advisories 1
- WID-SEC-2023-0432 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 20, 2023