Описание
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.
Ссылки
- Mailing ListThird Party Advisory
- Vendor Advisory
- Mailing ListThird Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
8.1 High
CVSS3
Дефекты
Связанные уязвимости
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file ...
Jenkins temporary uploaded file created with insecure permissions
Уязвимость сервера автоматизации Jenkins, связанная с неограниченной загрузкой файла опасного типа, позволяющая нарушителю получить доступ на чтение, изменение или удаление файлов
EPSS
8.1 High
CVSS3