Description
A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.
Remediation
References
https://jenkins.io/security/advisory/2018-05-09/#SECURITY-788
https://www.oracle.com/security-alerts/cpuapr2022.html
Related Vulnerabilities
CVE-2020-1929 Vulnerability in maven package org.apache.beam:beam-sdks-java-io-mongodb
CVE-2022-24785 Vulnerability in maven package org.fujion.webjars:moment
CVE-2018-1000409 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2019-16564 Vulnerability in maven package com.paul8620.jenkins.plugins:pipeline-aggregator-view
CVE-2021-43841 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore