A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.

Affected: Maven: org.jenkins-ci.main:jenkins-core

A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.

kibana: Arbitrary file inclusion vulnerability in the Console plugin jenkins: Arbitrary file write vulnerability using file parameter definitions jenkins: Reflected XSS vulnerability jenkins: Ephemeral user record creation jenkins: Session fixation vulnerability on user signup jenkins: Failures to process form submission data could result in secrets being displayed or written to logs jenkins: Path traversal vulnerability in Stapler allowed accessing internal data jenkins: Ephemeral user record was created on some invalid authentication attempts