1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-1634

[JENKINS:SECURITY-1634] `support-core` allowed users with Overall/Read permission to delete arbitrary files

Severity High
Affected Packages 2
Fixed Packages 2
CVEs 2
Info Packages References Vulnerabilities

support-core did not validate the paths submitted for the "Delete Support Bundles" feature.
This allowed users to delete arbitrary files on the Jenkins controller file system accessible to the OS user account running Jenkins.

Additionally, this endpoint did not perform a permission check, allowing users with Overall/Read permission to delete support bundles, and any arbitrary other file, with a known name/path.

support-core now only allows the deletion of support bundles and related files listed on the UI through this feature.
It also ensures that only users with "Download Bundle" permission are able to delete support bundles.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/support-core <= 2.63
pkg:github/jenkinsci/support-core-plugin <= 2.63
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/support-core = 2.64
pkg:github/jenkinsci/support-core-plugin = 2.64
ID
JENKINS:SECURITY-1634
Severity
high
Published
2019-11-21T00:00:00
(4 years ago)
Modified
2019-11-21T00:00:00
(4 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository support-core repository https://github.com/jenkinsci/support-core-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/support-core org.jenkins-ci.plugins support-core <= 2.63
Fixed pkg:maven/org.jenkins-ci.plugins/support-core org.jenkins-ci.plugins support-core = 2.64
Affected pkg:github/jenkinsci/support-core-plugin jenkinsci support-core-plugin <= 2.63
Fixed pkg:github/jenkinsci/support-core-plugin jenkinsci support-core-plugin = 2.64
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date