CVE-2023-32981

2023-05-1705:28:04

redhat.com

access.redhat.com

jenkins pipeline

utility steps plugin

remote attack

directory traversal

file manipulation

archive file validation

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

40.0%

JSON

A flaw was found in the Jenkins Pipeline Utility Steps Plugin. This flaw allows a remote, authenticated attacker to traverse directories on the system, caused by improper archive file validation. The attacker can use a specially crafted archive file containing “dot dot” sequences (/…/) to create or replace arbitrary files on the agent file system with attacker-specified content.