Description

Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and error messages allow attackers able to control agent processes to determine whether a file with a given name exists.

Remediation

References

https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2548

Related Vulnerabilities

CVE-2021-32730 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.tellstick

CVE-2020-10734 Vulnerability in maven package org.keycloak:keycloak-oidc-client-adapter-pom

CVE-2023-32985 Vulnerability in maven package org.jenkins-ci.plugins:sidebar-link

CVE-2023-28935 Vulnerability in maven package org.apache.uima:uima-ducc-parent

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Tags

Issue Tracking Patch Vendor Advisory NVD-CWE-noinfo