Description
A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.
Remediation
References
https://jenkins.io/security/advisory/2018-05-09/#SECURITY-788
https://www.oracle.com/security-alerts/cpuapr2022.html
Related Vulnerabilities
CVE-2023-38695 Vulnerability in npm package @simonsmith/cypress-image-snapshot
CVE-2010-1157 Vulnerability in maven package tomcat:catalina
CVE-2022-46175 Vulnerability in maven package org.webjars.bower:json5
CVE-2020-2282 Vulnerability in maven package org.jenkins-ci.plugins:implied-labels
CVE-2022-40634 Vulnerability in maven package org.craftercms:craftercms