Description
Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.
Remediation
References
http://rhn.redhat.com/errata/RHSA-2016-0489.html
https://access.redhat.com/errata/RHSA-2016:0070
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11
Related Vulnerabilities
CVE-2011-3375 Vulnerability in maven package org.apache.tomcat:coyote
CVE-2012-2733 Vulnerability in maven package org.apache.tomcat:coyote
CVE-2019-10419 Vulnerability in maven package org.jenkins-ci.plugins:application-director-plugin
CVE-2011-0013 Vulnerability in maven package org.apache.tomcat:catalina
CVE-2021-21141 Vulnerability in maven package org.webjars.npm:electron