Description
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
Remediation
References
Related Vulnerabilities
WordPress Plugin Timed Content Cross-Site Scripting (2.72)
WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery Cross-Site Scripting (1.5.75)
OpenSSL Session Fixation Vulnerability (CVE-1999-0428)
Oracle Database Server CVE-2014-6455 Vulnerability (CVE-2014-6455)
WordPress Plugin wpcu3er 'ajaxReq.php' Arbitrary File Upload (0.55)