Threats tagged 'ghsa-p2rf-wpxj-mx2g'

The Jenkins Credentials Binding Plugin versions 719.v80e905ef14eb_ and earlier contain a path traversal vulnerability that allows attackers with the ability to provide credentials to a job to write files to arbitrary locations on the node filesystem. This can lead to remote code execution if Jenkins is configured to allow low-privileged users to configure file or zip file credentials for jobs running on the built-in node. The vulnerability is fixed in version 720.v3f6decef43ea_, which sanitizes file names to prevent path traversal.