CVE-2023-46655

CWE-59CWE-22 — Path Traversal6 documents6 sources
Severity
6.5MEDIUM
EPSS
0.2%
top 57.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Cloudbees CD PluginJenkins Cloudbees CD
Timeline
PublishedOct 25

Description

Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are published during the 'CloudBees CD - Publish Artifact' post-build step, allowing attackers able to configure jobs to publish arbitrary files from the Jenkins controller file system to the previously configured CloudBees CD server.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

🔴Vulnerability Details

3
CVEList
CVE-2023-46655: Jenkins CloudBees CD Plugin 1↗2023-10-25
▶
OSV
Jenkins CloudBees CD Plugin vulnerable to arbitrary file read↗2023-10-25
▶
GHSA
Jenkins CloudBees CD Plugin vulnerable to arbitrary file read↗2023-10-25
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2023-10-25↗2023-10-25
▶

📄Research Papers

1
CTF
FesseMisk / README↗2024
▶
CVE-2023-46655 (MEDIUM CVSS 6.5) | Jenkins CloudBees CD Plugin 1.1.32 | cvebase.io