CVE-2023-46654

2023-10-2513:45:55

jenkins

www.cve.org

jenkins

cloudbees

cd plugin

vulnerability

cleanup process

file system

attack

0.0005 Low

EPSS

Percentile

16.1%

JSON

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the ‘CloudBees CD - Publish Artifact’ post-build step, allowing attackers able to configure jobs to delete arbitrary files on the Jenkins controller file system.

CNA Affected

[
  {
    "vendor": "Jenkins Project",
    "product": "Jenkins CloudBees CD Plugin",
    "versions": [
      {
        "version": "0",
        "versionType": "maven",
        "lessThanOrEqual": "1.1.32",
        "status": "affected"
      }
    ],
    "defaultStatus": "unaffected"
  }
]