Path Equivalence Affecting org.jenkins-ci.main:jenkins-core package, versions [,2.303.2) [2.304,2.315)
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
EPSS
0.05% (21st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIMAIN-3173604
- published 16 Dec 2022
- disclosed 24 May 2022
- credit Wadeck Follonier, Daniel Beck, James Nord
Introduced: 24 May 2022
CVE-2021-21682 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.main:jenkins-core to version 2.303.2, 2.315 or higher.
Overview
org.jenkins-ci.main:jenkins-core is an open source automation server.
Affected versions of this package are vulnerable to Path Equivalence such that when specifying a file or folder with a trailing dot character (example.), the file or folder will be treated as if that character was not present (example). As both are legal names for jobs and other entities, this can allow users with the appropriate permissions to change or replace configurations of jobs and other entities.