GHSA-478x-m3mx-7j3f

Source

https://github.com/advisories/GHSA-478x-m3mx-7j3f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-478x-m3mx-7j3f/GHSA-478x-m3mx-7j3f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-478x-m3mx-7j3f

Aliases

CVE-2024-28151

Published

2024-03-06T18:30:38Z

Modified

2024-10-31T19:25:20.783858Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Jenkins HTML Publisher Plugin Path traversal vulnerability

Details

Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to access it.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2024-03-06T17:15:10Z",
    "severity": "MODERATE",
    "github_reviewed_at": "2024-03-06T19:08:28Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:htmlpublisher

Package

Name: org.jenkins-ci.plugins:htmlpublisher; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/htmlpublisher

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.32.1

Affected versions

0.*

0.7

0.8

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

1.10

1.11

1.12

1.13

1.14

1.15

1.16

1.16.1

1.17

1.18

1.19

1.20

1.21

1.22-beta-1

1.22

1.23

1.24

1.25

1.26

1.27

1.28

1.29

1.30

1.31

1.32

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-478x-m3mx-7j3f/GHSA-478x-m3mx-7j3f.json"