CVE-2023-41930: Path Traversal
First published: Wed Sep 06 2023(Updated: )
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a history entry, allowing attackers to have Jenkins render a manipulated configuration history that was not created by the plugin.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Job Configuration History | <=1227.v7a_79fc4dc01f | |
| maven/org.jenkins-ci.plugins:jobConfigHistory | <=1227.v7a | 1229.v3039470161a_d |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for the Jenkins Job Configuration History Plugin?
The vulnerability ID for the Jenkins Job Configuration History Plugin is CVE-2023-41930.
What is the name of the affected plugin?
The affected plugin is Jenkins Job Configuration History Plugin.
What is the severity of the vulnerability?
The severity of the vulnerability is medium.
How can attackers exploit this vulnerability?
Attackers can exploit this vulnerability by manipulating the 'name' query parameter when rendering a history entry.
Are there any known fixes or patches for this vulnerability?
Yes, there are fixes available for this vulnerability. Please refer to the provided references for more information.
- collector/nvd-api
- collector/nvd-index
- agent/first-publish-date
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-c7r5-cww9-64q6
- alias/CVE-2023-41930
- agent/software-canonical-lookup
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- agent/event
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins job configuration history
- version/jenkins job configuration history/1227.v7a_79fc4dc01f
- package-manager/maven