CVE-2023-24449 — Jenkins Project / Jenkins PWauth Security Realm Plugin

Description (CNA)

Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Affected (CNA)

Vendor / product	Versions
Jenkins Project / Jenkins PWauth Security Realm Plugin	affected unspecified through 0.4; unknown next of 0.4 before unspecified

CWE

No CWE identifiers supplied.

References

https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2985

ADP enrichment

CVE

No English description supplied.

https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2985

CISA-ADP

No English description supplied.

No references supplied.