Описание
Jenkins MathWorks Polyspace Plugin vulnerable to arbitrary file read
Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier does not restrict the path of the attached files in Polyspace Notification post-build step.
This allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file system.
Пакеты
Наименование
com.mathworks.polyspace.jenkins:mathworks-polyspace
maven
Затронутые версииВерсия исправления
<= 1.0.5
Отсутствует
Связанные уязвимости
CVSS3: 6.5
nvd
больше 2 лет назад
Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file systems.