CVE-2023-32985

2023-05-1616:15:11

Google

osv.dev

jenkins

sidebar link plugin

overall/read permission

validation bypass

cve-2023-32985

file system

6.8 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.5%

JSON

Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

CPENameOperatorVersion
sidebar-link-plugineqsidebar-link-1.9.1
sidebar-link-plugineqsidebar-link-2.2.1
sidebar-link-plugineqsidebar-link-1.11.0
sidebar-link-plugineqsidebar-link-2.0.1
sidebar-link-plugineqsidebar-link-1.10
sidebar-link-plugineqsidebar-link-1.12.0
sidebar-link-plugineqsidebar-link-1.6
sidebar-link-plugineqsidebar-link-1.12.1
sidebar-link-plugineqsidebar-link-1.9
sidebar-link-plugineqsidebar-link-2.0.0

Name	Operator	Version
sidebar-link-plugin	eq	sidebar-link-1.9.1
sidebar-link-plugin	eq	sidebar-link-2.2.1
sidebar-link-plugin	eq	sidebar-link-1.11.0
sidebar-link-plugin	eq	sidebar-link-2.0.1
sidebar-link-plugin	eq	sidebar-link-1.10
sidebar-link-plugin	eq	sidebar-link-1.12.0
sidebar-link-plugin	eq	sidebar-link-1.6
sidebar-link-plugin	eq	sidebar-link-1.12.1
sidebar-link-plugin	eq	sidebar-link-1.9
sidebar-link-plugin	eq	sidebar-link-2.0.0