GHSA-xcrr-x93h-rv4v

Source

https://github.com/advisories/GHSA-xcrr-x93h-rv4v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-xcrr-x93h-rv4v/GHSA-xcrr-x93h-rv4v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xcrr-x93h-rv4v

Aliases

CVE-2023-50764

Published

2023-12-13T18:31:04Z

Modified

2024-12-06T05:40:07.794542Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

Arbitrary file deletion vulnerability in Jenkins Scriptler Plugin

Details

Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system.

Database specific

{
    "nvd_published_at": "2023-12-13T18:15:43Z",
    "severity": "HIGH",
    "cwe_ids": [],
    "github_reviewed_at": "2023-12-13T23:13:15Z",
    "github_reviewed": true
}

References

Affected packages

Maven / org.jenkins-ci.plugins:scriptler

Package

Name: org.jenkins-ci.plugins:scriptler; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/scriptler

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

342.v6a

Affected versions

2.*

2.0

2.1

2.2

2.2.1

2.3

2.4

2.4.1

2.5

2.5.1

2.6

2.6.1

2.7

2.9

3.*

3.0-alpha

3.1

3.2

3.3

3.4

3.5

318.*

318.v2031736b_0a_b_a_

321.*

321.v74a_851a_e7ed6

334.*

334.v29792d5a_c058

338.*

338.v7b_33a_7e18d4b_

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-xcrr-x93h-rv4v/GHSA-xcrr-x93h-rv4v.json"