6.5
Moyenne
CVE-2023-35147 Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an…
Description
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Jenkins AWS CodeCommit Trigger Plugin 3.0 | premières → 3.0.12 | Pas de correctif indiqué |
Autres CVE de Jenkins AWS CodeCommit Trigger Plugin
Les 5 CVE de Jenkins AWS CodeCommit Trigger Plugin →
CVE-2023-41944
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form…
Non notée
CVE-2023-41942
A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows…
Non notée
CVE-2023-41943
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint,…
Non notée
CVE-2023-41941
A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with…
Non notée