Description
Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and error messages allow attackers able to control agent processes to determine whether a file with a given name exists.
Remediation
References
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2548
Related Vulnerabilities
CVE-2019-5479 Vulnerability in npm package larvitbase-api
CVE-2022-23647 Vulnerability in npm package prismjs
CVE-2023-32695 Vulnerability in maven package org.webjars.npm:socket.io-parser
CVE-2022-24759 Vulnerability in npm package @chainsafe/libp2p-noise
CVE-2023-22899 Vulnerability in maven package net.lingala.zip4j:zip4j