Arbitrary File Read

2023-03-0700:49:53

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

jenkins

arbitrary file read

vulnerability

apache commons configuration

file system

0.001 Low

EPSS

Percentile

39.7%

JSON

jenkins-2-plugins is vulnerable to Arbitrary File Read. The library does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons configuration library that enable the file: prefix interpolator by default, allowing attackers to configure pipelines to read arbitrary files from the Jenkins controller file system.

CPENameOperatorVersion
jenkins-2-pluginseq4.9.1642418992__1.el8
jenkins-2-pluginseq4.9.1644822177__1.el8
jenkins-2-pluginseq4.7.1611636915__1.el8
jenkins-2-pluginseq4.8.1641573626__1.el8
jenkins-2-pluginseq4.8.1672842762__1.el8
jenkins-2-pluginseq4.7.1648800585__1.el8
jenkins-2-pluginseq4.6.1653312933__1.el8
jenkins-2-pluginseq4.6.1617886678__1.el8
jenkins-2-pluginseq4.8.1642609156__1.el8
jenkins-2-pluginseq4.10.1648739557__1.el8

Name	Operator	Version
jenkins-2-plugins	eq	4.9.1642418992__1.el8
jenkins-2-plugins	eq	4.9.1644822177__1.el8
jenkins-2-plugins	eq	4.7.1611636915__1.el8
jenkins-2-plugins	eq	4.8.1641573626__1.el8
jenkins-2-plugins	eq	4.8.1672842762__1.el8
jenkins-2-plugins	eq	4.7.1648800585__1.el8
jenkins-2-plugins	eq	4.6.1653312933__1.el8
jenkins-2-plugins	eq	4.6.1617886678__1.el8
jenkins-2-plugins	eq	4.8.1642609156__1.el8
jenkins-2-plugins	eq	4.10.1648739557__1.el8