Threats tagged 'ghsa-pvpc-w439-vmwf'

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability in their file browser that improperly identifies file paths attempting path traversal. This flaw allows attackers with Overall/Read permission to access metadata such as names, sizes, and last modification times of files within the Jenkins home directory. Additionally, attackers with Item/Workspace permission can obtain the names of jobs that have a workspace on the same agent.