Description

Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.

Remediation

References

https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455

Related Vulnerabilities

CVE-2022-40309 Vulnerability in maven package org.apache.archiva:maven2-repository

CVE-2022-35924 Vulnerability in npm package next-auth

CVE-2018-8088 Vulnerability in maven package org.slf4j:slf4j-ext

CVE-2017-2650 Vulnerability in maven package cprice404:pipeline-classpath

CVE-2022-45378 Vulnerability in maven package soap:soap

Severity

Critical

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory