GHSA-9jrh-hch8-rr5c
Jenkins Copy To Slave Plugin allows access to arbitrary files on the Jenkins controller file system
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:copy-to-slave | <= 1.4.4 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
An exposure of sensitive information vulnerability exists in Jenkins Copy To Slave Plugin version 1.4.4 and older in CopyToSlaveBuildWrapper.java that allows attackers with permission to configure jobs to read arbitrary files from the Jenkins master file system.
References
External links from the advisory. They lead to third-party sites.