PkgSeer

Vulnerability GHSA-cgh7-rgqg-hrcx

Medium Risk

3 years ago

Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin

1.10.0 - 2.6.0 and 2.8.0 - 2.17.0 and 2.19.0 - 2.30.0

Summary

Path traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin

Details

Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoints, allowing attackers with to delete attacker-specified directories on the Jenkins controller file system as long as they contain a file called 'history.xml'.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations

1.10.0 - 2.6.0 and 2.8.0 - 2.17.0 and 2.19.0 - 2.30.0 GHSA-8qr4-27mh-hqfr

XSS vulnerability in Jenkins Job Configuration History Plugin

1.10.0 - 2.6.0 and 2.8.0 - 2.17.0 and 2.19.0 - 2.30.0 GHSA-5jxp-f5rr-g6jc

Path traversal in Jenkins Job Configuration History Plugin

1.10.0 - 2.6.0 and 2.8.0 - 2.17.0 and 2.19.0 - 2.30.0 GHSA-c7r5-cww9-64q6

Job Configuration History Plugin's path traversal allows exploiting XXE vulnerability

1.10.0 - 2.6.0 and 2.8.0 - 2.17.0 and 2.19.0 - 2.30.0 GHSA-ghjw-fcf6-rpr9

Cross-site Scripting in Jenkins Job Configuration History Plugin

1.10.0 - 2.6.0 and 2.8.0 - 2.17.0 and 2.19.0 - 2.30.0 GHSA-28w4-h56g-grg7

View all vulnerabilities for these packages

Impacted packages

org.jenkins-ci.plugins:jobConfigHistory

Timeline

Published

3 years ago

Last Modified

2 years ago