medium4.3
CVE-2024-28151
Jenkins HTML Publisher Plugin Path traversal vulnerability
Impact
Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to access it.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:htmlpublisher | < 1.32.1 | 1.32.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Html Publisher | before 1.32.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2024/03/06/3
- https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3303
- https://github.com/advisories/GHSA-478x-m3mx-7j3f
- https://nvd.nist.gov/vuln/detail/CVE-2024-28151
- https://github.com/jenkinsci/htmlpublisher-plugin/commit/6b840248dd0d691bbac9b515cd750b3f925909b2