6.5
Medium
CVE-2023-35147 Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an…
Description
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins AWS CodeCommit Trigger Plugin 3.0 | earliest → 3.0.12 | No fix stated |
Other CVEs of Jenkins AWS CodeCommit Trigger Plugin
The 5 CVEs of Jenkins AWS CodeCommit Trigger Plugin →
CVE-2023-41944
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form…
Not rated
CVE-2023-41942
A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows…
Not rated
CVE-2023-41943
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint,…
Not rated
CVE-2023-41941
A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with…
Not rated