GHSA-89vc-7frq-2rfj

Jenkins has Local File Inclusion Vulnerability

En bref

Publiée: 2022-05-13 01:30 UTC
Mise à jour: 2025-03-13 18:40 UTC
CVE: CVE-2015-5322
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Description

Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.

Paquets affectés

Paquet	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 1.626, fixed 1.638
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, fixed 1.625.2

Références

https://nvd.nist.gov/vuln/detail/CVE-2015-5322 ADVISORY
https://github.com/jenkinsci/jenkins/commit/5431e397216b4ab80e58bdabcb06a0066bce6592 WEB
https://access.redhat.com/errata/RHSA-2016:0070 WEB
https://github.com/jenkinsci/jenkins PACKAGE
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 WEB
http://rhn.redhat.com/errata/RHSA-2016-0489.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database