Description
Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
Remediation
References
https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455
Related Vulnerabilities
CVE-2020-6428 Vulnerability in npm package electron
CVE-2023-40351 Vulnerability in maven package org.jenkins-ci.plugins:favorite-view
CVE-2016-6793 Vulnerability in maven package org.apache.wicket:wicket-util
CVE-2023-4061 Vulnerability in maven package org.wildfly.core:wildfly-controller
CVE-2018-1999041 Vulnerability in maven package com.tinfoilsecurity.plugins:tinfoil-scan