medium6.5
CVE-2023-37960
Jenkins MathWorks Polyspace Plugin vulnerable to arbitrary file read
Impact
Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier does not restrict the path of the attached files in Polyspace Notification post-build step. This allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file system.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.mathworks.polyspace.jenkins:mathworks-polyspace | <= 1.0.5 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Mathworks Polyspace | through 1.0.5 |