Lucene search

Veracode Vulnerability DatabaseVERACODE:45187

HistoryJan 29, 2024 - 7:12 a.m.

Path Traversal

2024-01-2907:12:08

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

path traversal

jenkins

configuration

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.9%

JSON

Jenkins Matrix Project Plugin is vulnerable to Path Traversal. The vulnerability is caused due to improper sanitization of user-defined axis names in multi-configuration projects. This could allow an attacker to manipulate or replace the config.xml files with arbitrary content, resulting in Path Traversal.

CPENameOperatorVersion
matrix project pluginle818.v7eb_e657db_924
matrix project pluginle818.v7eb_e657db_924

CPE	Name	Operator	Version
	matrix project plugin	le	818.v7eb_e657db_924
	matrix project plugin	le	818.v7eb_e657db_924

References

www.openwall.com/lists/oss-security/2024/01/24/6

github.com/advisories/GHSA-cjgm-9vc9-56mx

github.com/jenkinsci/matrix-project-plugin/commit/f7a5b24905f69896234da34250171c1be80cddb4

www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3289