Description

A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.

Remediation

References

https://jenkins.io/security/advisory/2018-06-25/#SECURITY-440

Related Vulnerabilities

CVE-2018-15758 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth2

CVE-2023-24436 Vulnerability in maven package org.jenkins-ci.plugins:ghprb

CVE-2023-4853 Vulnerability in maven package io.quarkus:quarkus-csrf-reactive

CVE-2019-0224 Vulnerability in maven package org.apache.jspwiki:jspwiki-builder

CVE-2020-16022 Vulnerability in maven package org.webjars.npm:electron

Severity

High

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory