Description
A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.
Remediation
References
https://jenkins.io/security/advisory/2018-05-09/#SECURITY-788
https://www.oracle.com/security-alerts/cpuapr2022.html
Related Vulnerabilities
CVE-2023-40339 Vulnerability in maven package org.jenkins-ci.plugins:config-file-provider
CVE-2014-0225 Vulnerability in maven package org.springframework:spring-web
CVE-2020-1961 Vulnerability in maven package org.apache.syncope.core:syncope-core-provisioning-java
CVE-2011-1582 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2023-6927 Vulnerability in maven package org.keycloak:keycloak-common