CVE-2018-6356
mediumPriorität · verfolgen · 27EPSS 0.039 · 90. PerzentilEUUSEPSS · bewertet 2026-10-27
Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Overall/Read permission to download files from the Jenkins master they should not have access to. On Windows, any file accessible to the Jenkins master process could be downloaded. On other operating systems, any file within the Jenkins home directory accessible to the Jenkins master process could be downloaded.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (6)
Betroffene Produkte und Versionsbereiche.
- oracle communications cloud native core automated test suite= 1.9.0nvdUScpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-5p59-v5wm-77v4Improper Limitation of a Pathname to a Restricted Directory in Jenkins2022-05-13ghsa · osvUS
Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Overall/Read permission to download files from the Jenkins master they should not have access to. On Windows, any file accessible to the Jenkins master process could be downloaded. On other operating systems, any file within the Jenkins home directory accessible to the Jenkins master process could be downloaded.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (12)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2018/02/14/1cnnvd
- https://jenkins.io/security/advisory/2018-02-14/cnnvd
- https://www.oracle.com/security-alerts/cpuapr2022.htmlcnnvd
- https://www.securityfocus.com/bid/103037cnnvd
- http://www.openwall.com/lists/oss-security/2018/02/14/1enisa_euvd
- http://www.securityfocus.com/bid/103037enisa_euvd
- https://jenkins.io/security/advisory/2018-02-14/enisa_euvd
- https://www.oracle.com/security-alerts/cpuapr2022.htmlenisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan