PT-2018-9345 · Jenkins · Jenkins Html Publisher Plugin+1

Kalle Niemitalo · Publicado 2018-05-08 · Atualizado 2022-05-14 · CVE-2018-1000175

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins HTML Publisher Plugin versions 1.15 and older

Description A path traversal issue exists in the HtmlPublisherTarget.java file, allowing attackers who can configure the HTML Publisher build step to override arbitrary files on the Jenkins master. This issue is related to the handling of report names, which in vulnerable versions do not properly escape non-alphanumeric characters for use as part of a URL and as a directory name.

Recommendations For Jenkins HTML Publisher Plugin versions 1.15 and older, update to version 1.16 or newer, which escapes non-alphanumeric characters in report names for use as part of a URL and as a directory name, addressing the path traversal issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-1000175

GHSA-4X63-3P7Q-XMH7

Produtos afetados

Jenkins

Jenkins Html Publisher Plugin

Referências · 5

• https://github.com/jenkinsci/htmlpublisher-plugin · Nota
• https://jenkins.io/security/advisory/2018-04-16 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-4x63-3p7q-xmh7 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000175 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000175 · Nota de Segurança