Symbolic Link

2022-04-2100:42:47

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

28.6%

JSON

Jenkins Pipeline is vulnerable to symbolic links. It follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system. A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step. This flaw allows attackers who can configure Pipelines to read arbitrary files on the Jenkins controller file system.

CPENameOperatorVersion
jenkins-2-pluginseq4.9.1643389956__1.el8
jenkins-2-pluginseq4.8.1633555500__1.el8
jenkins-2-pluginseq4.7.1643883495__1.el8
jenkins-2-pluginseq4.6.1617886678__1.el8
jenkins-2-pluginseq4.9.1642418992__1.el8
jenkins-2-pluginseq4.9.1642607680__1.el8
jenkins-2-pluginseq4.8.1624022417__1.el8
jenkins-2-pluginseq4.7.1611636915__1.el8
jenkins-2-pluginseq4.6.1637602169__1.el8
jenkins-2-pluginseq4.6.1612257979__1.el8

Name	Operator	Version
jenkins-2-plugins	eq	4.9.1643389956__1.el8
jenkins-2-plugins	eq	4.8.1633555500__1.el8
jenkins-2-plugins	eq	4.7.1643883495__1.el8
jenkins-2-plugins	eq	4.6.1617886678__1.el8
jenkins-2-plugins	eq	4.9.1642418992__1.el8
jenkins-2-plugins	eq	4.9.1642607680__1.el8
jenkins-2-plugins	eq	4.8.1624022417__1.el8
jenkins-2-plugins	eq	4.7.1611636915__1.el8
jenkins-2-plugins	eq	4.6.1637602169__1.el8
jenkins-2-plugins	eq	4.6.1612257979__1.el8