GHSA-hph9-9vcq-f7gp

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

At a glance

Published: 2022-05-14 01:04 UTC
Updated: 2024-02-16 08:19 UTC
CVE: CVE-2018-1000862
CVSS_V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.

Affected packages

Package	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, fixed 2.138.4
Maven · org.jenkins-ci.main:jenkins-core	introduced 2.140, fixed 2.154

References

https://nvd.nist.gov/vuln/detail/CVE-2018-1000862 ADVISORY
https://github.com/jenkinsci/jenkins/commit/c19cc705688cfffa4fe735e0edbe84862b6c135f WEB
https://access.redhat.com/errata/RHBA-2019:0024 WEB
https://jenkins.io/security/advisory/2018-12-05/#SECURITY-904 WEB
http://www.securityfocus.com/bid/106176 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database