CVE-2023-24449
Assigner: jenkins
Published: 2023-01-24T00:00:00
State: PUBLISHED
affected: product: Jenkins PWauth Security Realm Plugin
vendor: Jenkins Project
versions: lessThanOrEqual: 0.4
status: affected
version: unspecified
versionType: custom
lessThan: unspecified
status: unknown
version: next of 0.4
versionType: custom
descriptions: value: Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.