Description
Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Remediation
References
https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455
Related Vulnerabilities
CVE-2022-42735 Vulnerability in maven package org.apache.shenyu:shenyu-admin
CVE-2021-41571 Vulnerability in maven package org.apache.pulsar:pulsar
CVE-2020-17527 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2023-38493 Vulnerability in maven package com.linecorp.armeria:armeria
CVE-2023-27987 Vulnerability in maven package org.apache.linkis:linkis-cs-client