PT-2017-8638 · Jenkins · Jenkins Image Gallery Plugin+1

Ben Walding · Published 2017-02-09 · Updated 2022-05-13 · CVE-2016-4987

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Image Gallery plugin versions prior to 1.4

Description A directory traversal issue in the Image Gallery plugin allows remote attackers to list arbitrary directories and read arbitrary files via unspecified form fields.

Recommendations For Jenkins Image Gallery plugin versions prior to 1.4, update to version 1.4 or later to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2016-4987

GHSA-8XR3-54W2-8XJP

Affected Products

Jenkins

Jenkins Image Gallery Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-8xr3-54w2-8xjp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4987 · Security Note
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4987 · Vendor Advisory
• https://github.com/jenkinsci/image-gallery-plugin/commit/20f02f6d53e642431d5e1181a8e7be7971538d50 · Note
• https://github.com/jenkinsci/image-gallery-plugin · Note