PkgSeer

Vulnerability GHSA-c7r5-cww9-64q6

Medium Risk

3 years ago

Path traversal in Jenkins Job Configuration History Plugin

1.10.0 - 2.6.0 and 2.8.0 - 2.17.0 and 2.19.0 - 2.30.0

Summary

Path traversal in Jenkins Job Configuration History Plugin

Details

Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations

1.10.0 - 2.6.0 and 2.8.0 - 2.17.0 and 2.19.0 - 2.30.0 GHSA-8qr4-27mh-hqfr

XSS vulnerability in Jenkins Job Configuration History Plugin

1.10.0 - 2.6.0 and 2.8.0 - 2.17.0 and 2.19.0 - 2.30.0 GHSA-5jxp-f5rr-g6jc

Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin

1.10.0 - 2.6.0 and 2.8.0 - 2.17.0 and 2.19.0 - 2.30.0 GHSA-cgh7-rgqg-hrcx

Job Configuration History Plugin's path traversal allows exploiting XXE vulnerability

1.10.0 - 2.6.0 and 2.8.0 - 2.17.0 and 2.19.0 - 2.30.0 GHSA-ghjw-fcf6-rpr9

Cross-site Scripting in Jenkins Job Configuration History Plugin

1.10.0 - 2.6.0 and 2.8.0 - 2.17.0 and 2.19.0 - 2.30.0 GHSA-28w4-h56g-grg7

View all vulnerabilities for these packages

Impacted packages

org.jenkins-ci.plugins:jobConfigHistory

Timeline

Published

3 years ago

Last Modified

2 years ago