CVE-2019-10352 — Path Traversal in Jenkins

CWE-22 — Path Traversal8 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
40.4%
top 2.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
JenkinsJenkins Project Jenkins
Timeline
PublishedJul 17
Latest updateMay 24

Description

A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDjenkins/jenkins2.176.1+1
▶CVEListV5jenkins_project/jenkins2.185 and earlier, LTS 2.176.1 and earlier

🔴Vulnerability Details

3
GHSA
Improper Limitation of a Pathname to a Restricted Directory in Jenkins↗2022-05-24
▶
OSV
Improper Limitation of a Pathname to a Restricted Directory in Jenkins↗2022-05-24
▶
CVEList
CVE-2019-10352: A path traversal vulnerability in Jenkins 2↗2019-07-17
▶

📋Vendor Advisories

2
Red Hat
jenkins: Arbitrary file write vulnerability using file parameter definitions (SECURITY-1424)↗2019-07-17
▶
Jenkins
Jenkins Security Advisory 2019-07-17↗2019-07-17
▶

💬Community

2
Bugzilla
CVE-2019-10352 jenkins: Arbitrary file write vulnerability using file parameter definitions (SECURITY-1424) [fedora-all]↗2019-07-17
▶
Bugzilla
CVE-2019-10352 jenkins: Arbitrary file write vulnerability using file parameter definitions (SECURITY-1424)↗2019-07-17
▶
CVE-2019-10352 — Path Traversal in Jenkins | cvebase