What is GHSA-x646-m7x2-gcp7?

GHSA-x646-m7x2-gcp7 is a security advisory published by GitHub Security Advisories with High severity. Path Traversal in Jenkins

Which CVE IDs does GHSA-x646-m7x2-gcp7 cover?

GHSA-x646-m7x2-gcp7 covers the following CVE IDs: CVE-2018-1000194. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x646-m7x2-gcp7?

GHSA-x646-m7x2-gcp7 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-x646-m7x2-gcp7?

GHSA-x646-m7x2-gcp7 affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003c= 2.107.2; maven/org.jenkins-ci.main:jenkins-core:\u003e= 2.108, \u003c= 2.120.

GHSA-x646-m7x2-gcp7HighCVSS 8.1

Path Traversal in Jenkins

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000194 →

📋 Description

A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:<= 2.107.2
maven/org.jenkins-ci.main:jenkins-core:>= 2.108, <= 2.120

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000194
https://jenkins.io/security/advisory/2018-05-09/#SECURITY-788
https://www.oracle.com/security-alerts/cpuapr2022.html
https://github.com/jenkinsci/jenkins/commit/5cf0a77d44310523b763698f67d645c1f2427f30
https://github.com/advisories/GHSA-x646-m7x2-gcp7