Description

A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins master process is running as.

Remediation

References

https://jenkins.io/security/advisory/2018-06-25/#SECURITY-870

Related Vulnerabilities

CVE-2022-24728 Vulnerability in npm package ckeditor4

CVE-2023-22893 Vulnerability in npm package @strapi/plugin-users-permissions

CVE-2022-41244 Vulnerability in maven package org.jenkins-ci.plugins:view26

CVE-2020-5404 Vulnerability in maven package io.projectreactor.netty:reactor-netty

CVE-2021-21379 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-wikimacro-store

Severity

High

Classification

CWE-20 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Vendor Advisory