Path Traversal in Jenkins

CVE-2015-5322

Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.032 (86.6th percentile) — read the EPSS interpretation.

Affected products

Jenkins
Redhat Openshift — versions 2.0
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)