Lucene search

Veracode Vulnerability DatabaseVERACODE:39572

HistoryMar 07, 2023 - 12:49 a.m.

Arbitrary File Read

2023-03-0700:49:53

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

27.4%

JSON

jenkins-2-plugins is vulnerable to Arbitrary File Read. The library does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons configuration library that enable the file: prefix interpolator by default, allowing attackers to configure pipelines to read arbitrary files from the Jenkins controller file system.

CPENameOperatorVersion
jenkins-2-pluginseq4.9.1642418992__1.el8
jenkins-2-pluginseq4.9.1644822177__1.el8
jenkins-2-pluginseq4.7.1611636915__1.el8
jenkins-2-pluginseq4.8.1641573626__1.el8
jenkins-2-pluginseq4.8.1672842762__1.el8
jenkins-2-pluginseq4.7.1648800585__1.el8
jenkins-2-pluginseq4.6.1653312933__1.el8
jenkins-2-pluginseq4.6.1617886678__1.el8
jenkins-2-pluginseq4.8.1642609156__1.el8
jenkins-2-pluginseq4.10.1648739557__1.el8

Name	Operator	Version
jenkins-2-plugins	eq	4.9.1642418992__1.el8
jenkins-2-plugins	eq	4.9.1644822177__1.el8
jenkins-2-plugins	eq	4.7.1611636915__1.el8
jenkins-2-plugins	eq	4.8.1641573626__1.el8
jenkins-2-plugins	eq	4.8.1672842762__1.el8
jenkins-2-plugins	eq	4.7.1648800585__1.el8
jenkins-2-plugins	eq	4.6.1653312933__1.el8
jenkins-2-plugins	eq	4.6.1617886678__1.el8
jenkins-2-plugins	eq	4.8.1642609156__1.el8
jenkins-2-plugins	eq	4.10.1648739557__1.el8

Rows per page:

1-10 of 961

References

www.openwall.com/lists/oss-security/2022/11/15/4

access.redhat.com/errata/RHSA-2023:0777

access.redhat.com/security/updates/classification/#critical

bugzilla.redhat.com/show_bug.cgi?id=2143089

docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html

www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2949

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

27.4%

JSON

Related for VERACODE:39572