CVE-2025-67643: Path Traversal
Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b9517b6b202 and earlier does not correctly perform path validation of the workspace directory while uploading artifacts to Jira, allowing attackers with Item/Configure permission to retrieve files present on the Jenkins controller workspace directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67643?
CVE-2025-67643 is classified as a high severity vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2025-67643?
To mitigate CVE-2025-67643, update the Jenkins Pipeline Reporter for Jira Plugin to version 1.054.v7b_9517b_6b_202 or later.
What are the consequences of CVE-2025-67643?
CVE-2025-67643 allows attackers with Item/Configure permission to access files in the Jenkins controller workspace, leading to potential data exposure.
Who is affected by CVE-2025-67643?
Users of Jenkins Pipeline Reporter for Jira Plugin version 1.054.v7b_9517b_6b_202 and earlier are affected by CVE-2025-67643.
What actions can be taken to prevent CVE-2025-67643?
In addition to updating the plugin, audit user permissions to limit access to the Item/Configure permission for sensitive files.