Description
Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Remediation
References
https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455
Related Vulnerabilities
CVE-2023-28103 Vulnerability in npm package matrix-react-sdk
CVE-2022-45136 Vulnerability in maven package org.apache.jena:jena-sdb
CVE-2016-6637 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-login
CVE-2022-24697 Vulnerability in maven package org.apache.kylin:kylin-core-common
CVE-2019-3795 Vulnerability in maven package org.springframework.security:spring-security-core