[MAVEN:GHSA-QF38-F2FR-Q4X9] Improper Input Validation in Jenkins

Severity High

Affected Packages 2

Fixed Packages 2

CVEs 1

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.

Package	Affected Version
pkg:maven/org.jenkins-ci.main/jenkins-core	>= 2.122, < 2.132
pkg:maven/org.jenkins-ci.main/jenkins-core	< 2.121.2

Package	Fixed Version
pkg:maven/org.jenkins-ci.main/jenkins-core	= 2.132
pkg:maven/org.jenkins-ci.main/jenkins-core	= 2.121.2

ID

MAVEN:GHSA-QF38-F2FR-Q4X9

Severity

high

URL

https://github.com/advisories/GHSA-qf38-f2fr-q4x9

Published

2022-05-13T01:01:02
(2 years ago)

Modified

2023-12-18T11:51:53
(9 months ago)

Rights

Maven Security Team

Other Advisories

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2018-1999002
			https://jenkins.io/security/advisory/2018-07-18/#SECURITY-914
			https://www.exploit-db.com/exploits/46453/
			https://www.oracle.com/security-alerts/cpuapr2022.html
			https://github.com/jenkinsci/jenkins/commit/29ca81dd59c255ad633f1bd86cf1be40a5f02c64
			https://github.com/jenkinsci/stapler/commit/8e9679b08c36a2f0cf2a81855d5e04e2ed2ac2b3
			https://github.com/advisories/GHSA-qf38-f2fr-q4x9

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/org.jenkins-ci.main/jenkins-core	org.jenkins-ci.main	jenkins-core	>= 2.122 < 2.132
Fixed	pkg:maven/org.jenkins-ci.main/jenkins-core	org.jenkins-ci.main	jenkins-core	= 2.132
Affected	pkg:maven/org.jenkins-ci.main/jenkins-core	org.jenkins-ci.main	jenkins-core	< 2.121.2
Fixed	pkg:maven/org.jenkins-ci.main/jenkins-core	org.jenkins-ci.main	jenkins-core	= 2.121.2

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date