What is GHSA-8864-pwhg-3mp2?

GHSA-8864-pwhg-3mp2 is a security advisory published by GitHub Security Advisories with Medium severity. Arbitrary file write vulnerability in Jenkins Fortify CloudScan Plugin

Which CVE IDs does GHSA-8864-pwhg-3mp2 cover?

GHSA-8864-pwhg-3mp2 covers the following CVE IDs: CVE-2018-1000607. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8864-pwhg-3mp2?

GHSA-8864-pwhg-3mp2 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-8864-pwhg-3mp2?

GHSA-8864-pwhg-3mp2 affects 1 product, including: maven/org.jenkins-ci.plugins:fortify-cloudscan-jenkins-plugin:\u003c= 1.5.1.

GHSA-8864-pwhg-3mp2MediumCVSS 6.5

Arbitrary file write vulnerability in Jenkins Fortify CloudScan Plugin

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 30, 2024

🔗 CVE IDs covered (1)

CVE-2018-1000607 →

📋 Description

A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins master process is running as.

🎯 Affected products1

maven/org.jenkins-ci.plugins:fortify-cloudscan-jenkins-plugin:<= 1.5.1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000607
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-870
https://github.com/advisories/GHSA-8864-pwhg-3mp2