Description
The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files.
Remediation
References
Related Vulnerabilities
ATutor Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3706)
WordPress Plugin Travelpayouts:All Travel Brands in One Place Cross-Site Scripting (0.7.12)
WordPress Plugin Advanced Access Manager Security Bypass (3.2.1)
WordPress Plugin SEO Redirection-301 Redirect Manager Unspecified Vulnerability (8.7)
WordPress Plugin Monsters Editor for WP Super Edit Arbitrary File Upload (1.1)