Description
A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.
Remediation
References
https://jenkins.io/security/advisory/2018-05-09/#SECURITY-788
https://www.oracle.com/security-alerts/cpuapr2022.html
Related Vulnerabilities
CVE-2018-6873 Vulnerability in npm package auth0-js
CVE-2023-34212 Vulnerability in maven package org.apache.nifi:nifi-jms-processors
CVE-2012-1154 Vulnerability in maven package org.jboss.native:mod-cluster
CVE-2021-40331 Vulnerability in maven package org.apache.ranger:ranger-hive-plugin
CVE-2017-1000404 Vulnerability in maven package se.diabol.jenkins.pipeline:delivery-pipeline-plugin