Описание
Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.
A flaw was found in The Matrix Project Plugin for Jenkins, which does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This issue may allow attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system with content not controllable by the attackers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | jenkins | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.11 | jenkins-2-plugins | Out of support scope | ||
| OCP-Tools-4.12-RHEL-8 | jenkins | Fixed | RHSA-2024:3635 | 05.06.2024 |
| OCP-Tools-4.12-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2024:3635 | 05.06.2024 |
| OCP-Tools-4.13-RHEL-8 | jenkins | Fixed | RHSA-2024:3636 | 05.06.2024 |
| OCP-Tools-4.13-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2024:3636 | 05.06.2024 |
| OCP-Tools-4.14-RHEL-8 | jenkins | Fixed | RHSA-2024:3634 | 05.06.2024 |
| OCP-Tools-4.14-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2024:3634 | 05.06.2024 |
| OCP-Tools-4.15-RHEL-8 | jenkins | Fixed | RHSA-2024:4597 | 17.07.2024 |
| OCP-Tools-4.15-RHEL-8 | jenkins-2-plugins | Fixed | RHSA-2024:4597 | 17.07.2024 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.6 Medium
CVSS3
Связанные уязвимости
Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.
Path traversal vulnerability in Jenkins Matrix Project Plugin
Уязвимость плагина Jenkins Git Matrix Project, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю оказывать воздействие на целостность защищаемой информации
EPSS
4.6 Medium
CVSS3