Description

A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.

Remediation

References

https://jenkins.io/security/advisory/2018-06-25/#SECURITY-440

Related Vulnerabilities

CVE-2021-36774 Vulnerability in maven package org.apache.kylin:kylin-core-common

CVE-2020-24590 Vulnerability in maven package org.wso2.carbon.governance:org.wso2.carbon.governance.generic.ui

CVE-2017-12649 Vulnerability in maven package com.liferay:com.liferay.asset.browser.web

CVE-2018-1000665 Vulnerability in maven package org.webjars.npm:dojo

CVE-2022-40955 Vulnerability in maven package org.apache.inlong:sort-connector-jdbc

Severity

High

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory