Description
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.
Remediation
References
http://www.openwall.com/lists/oss-security/2021/11/04/3
https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2428
Related Vulnerabilities
CVE-2023-24057 Vulnerability in maven package org.hl7.fhir.publisher:org.hl7.fhir.publisher.core
CVE-2021-24122 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2020-28433 Vulnerability in npm package node-latex-pdf
CVE-2020-2165 Vulnerability in maven package org.jenkins-ci.plugins:artifactory
CVE-2019-9155 Vulnerability in maven package org.webjars.npm:openpgp