Threats tagged 'ghsa-gmh6-98p7-vvcx'

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have an HTTP endpoint that loads agents by name without validating the name. This flaw allows attackers with Overall/Read permission to load any config.xml file from the controller's file system as an agent configuration and overwrite arbitrary config.xml files when saving the agent, potentially leading to arbitrary code execution.