Description
A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.
Remediation
References
https://jenkins.io/security/advisory/2018-05-09/#SECURITY-788
https://www.oracle.com/security-alerts/cpuapr2022.html
Related Vulnerabilities
CVE-2018-6874 Vulnerability in maven package org.webjars.bower:auth0-lock
CVE-2022-39135 Vulnerability in maven package org.apache.calcite:calcite-core
CVE-2019-10434 Vulnerability in maven package com.mtvi.plateng.hudson:ldapemail
CVE-2019-10305 Vulnerability in maven package com.xebialabs.xl-deploy:jenkins-dependendencies
CVE-2019-10240 Vulnerability in maven package org.eclipse.hawkbit:hawkbit-parent