Description
Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Remediation
References
https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455
Related Vulnerabilities
CVE-2019-10455 Vulnerability in maven package org.jenkins-ci.plugins:rundeck
CVE-2022-43425 Vulnerability in maven package io.jenkins.plugins:custom-checkbox-parameter
CVE-2019-10461 Vulnerability in maven package org.jenkins-ci.plugins:dynatrace-dashboard
CVE-2012-2379 Vulnerability in maven package org.apache.cxf:cxf-rt-ws-security
CVE-2016-10027 Vulnerability in maven package org.igniterealtime.smack:smack-tcp