Description
FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controller access permission on the source path, instead of 'delete'.
Remediation
References
Related Vulnerabilities
WordPress Plugin WPCS-WordPress Currency Switcher Cross-Site Request Forgery (1.1.6)
WordPress Plugin Credova_Financial Information Disclosure (1.4.8)
WordPress Plugin Modula Image Gallery Cross-Site Scripting (2.2.4)
WordPress Plugin Top 10-Popular posts for WordPress Cross-Site Request Forgery (1.9.2)
WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-17671)