Description
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions.
Remediation
References
http://www.openwall.com/lists/oss-security/2021/11/04/3
https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2428
Related Vulnerabilities
CVE-2016-5004 Vulnerability in maven package org.apache.xmlrpc:xmlrpc
CVE-2022-36891 Vulnerability in maven package org.jenkins-ci.plugins:deployer-framework
CVE-2020-26234 Vulnerability in maven package org.opencastproject:opencast-kernel
CVE-2019-3795 Vulnerability in maven package org.springframework.security:spring-security-core
CVE-2022-2596 Vulnerability in maven package org.webjars.npm:node-fetch