CVE-2023-46655

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to publish arbitrary files from the Jenkins...

CVE-2023-46655

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to publish arbitrary files from the Jenkins...

CVE-2023-46655

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to publish arbitrary files from the Jenkins...

CVE-2023-46654

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to delete arbitrary files on the Jenkins controller...

CVE-2023-46654

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to delete arbitrary files on the Jenkins controller...

CVE-2023-46654

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to delete arbitrary files on the Jenkins controller...

CVE-2023-46654

CVE-2023-46654 affects Jenkins CloudBees CD Plugin 1.1.32 and earlier. The cleanup step “CloudBees CD - Publish Artifact” follows symbolic links to locations outside the expected directory, enabling an attacker who can configure jobs to delete arbitrary files on the Jenkins controller filesystem....

CVE-2023-46654: Improper Link Resolution Before File Access

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to delete arbitrary files on the Jenkins controller...

PT-2023-6543 · Cloudbees +1 · Jenkins Cloudbees Cd Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins CloudBees CD Plugin versions 1.1.32 and earlier Description: The issue is related to the handling of symbolic links during the cleanup process of the 'CloudBees CD - Publish Artifact' post-build step. This allows attackers who can...

Jenkins Plugin CloudBees CD Backlinking Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Arbitrary file read vulnerability in electricflow

electricflow temporarily copies files from an agent workspace to the controller in preparation for publishing them in the 'CloudBees CD - Publish Artifact' post-build step. electricflow 1.1.32 and earlier follows symbolic links to locations outside of the temporary directory on the controller whe...

CVE-2023-46655: Improper Link Resolution Before File Access

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to publish arbitrary files from the Jenkins...

Jenkins Plugin CloudBees CD Backlinking Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2023-30144 · Cloudbees +1 · Jenkins Cloudbees Cd Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins CloudBees CD Plugin versions 1.1.32 and earlier Description: The issue allows attackers who can configure jobs to publish arbitrary files from the Jenkins controller file system to the previously configured CloudBees CD server. This i...

Information Disclosure

org.jenkins-ci.plugins, cloudbees-folder is vulnerable to Information Disclosure. The vulnerability exists because the library does not properly restrict the organization folder log file location, which allows an attacker to gain access to sensitive information in the system...

io.fabric8.jenkins.plugins:openshift-sync (>=0.9.1, <=1.0.30), io.jenkins.blueocean:blueocean (1.0.0-b25) +12 more potentially affected by CVE-2023-40338 via org.jenkins-ci.plugins:cloudbees-folder (5.18)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 5.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - io.fabric8.jenkins.plugins:openshift-sync =0.9.1, =2.15, =1.0, =1.7.6, =1.8.15...

org.jenkins-ci.plugins:job-dsl (>=1.20, <=1.28) potentially affected by CVE-2023-40336 via org.jenkins-ci.plugins:cloudbees-folder (4.2)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:job-dsl =1.20, =1.28 Source cves: CVE-2023-40336 Source...

com.amadeus.jenkins.plugins:workflow-cps-global-lib-http (>=2.33.0, <=2.54.0), com.datapipe.jenkins.plugins:hashicorp-vault-plugin (>=2.0.0, <=2.2.0) +46 more potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (>=6.0.1, <=6.815.v0dd5a_cb_40e0e)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version =6.0.1, =2.33.0, =2.0.0, =7.5.7, =1.0.31, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =0.2.0, =1.1.0-beta-4, =1.27.11 and more Source cves: CVE-2023-40337 Source advisory:...

org.jenkins-ci.plugins:job-dsl (1.19) potentially affected by CVE-2023-40337 via org.jenkins-ci.plugins:cloudbees-folder (4.0)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:job-dsl 1.19 Source cves: CVE-2023-40337 Source advisory:...

org.jenkins-ci.plugins:job-dsl (1.19) potentially affected by CVE-2023-40338 via org.jenkins-ci.plugins:cloudbees-folder (4.0)

org.jenkins-ci.plugins:cloudbees-folder MAVEN version 4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:cloudbees-folder and may be impacted: - org.jenkins-ci.plugins:job-dsl 1.19 Source cves: CVE-2023-40338 Source advisory:...