Description
A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.
Remediation
References
https://jenkins.io/security/advisory/2018-05-09/#SECURITY-788
https://www.oracle.com/security-alerts/cpuapr2022.html
Related Vulnerabilities
CVE-2018-1000054 Vulnerability in maven package org.jvnet.hudson.plugins:ccm
CVE-2023-46122 Vulnerability in maven package org.scala-sbt:io_3
CVE-2023-39156 Vulnerability in maven package org.jenkins-ci.plugins:bazaar
CVE-2021-31635 Vulnerability in maven package com.jfinal:jfinal
CVE-2022-31023 Vulnerability in maven package com.typesafe.play:play_2.13