Description
Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Remediation
References
https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455
Related Vulnerabilities
CVE-2022-36883 Vulnerability in maven package org.jenkins-ci.plugins:git
CVE-2016-4055 Vulnerability in maven package org.webjars.bowergithub.moment:moment
CVE-2017-4972 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-common
CVE-2020-2274 Vulnerability in maven package org.jenkins-ci.plugins:elastestv
CVE-2019-10348 Vulnerability in maven package org.jenkins-ci.plugins:gogs-webhook