~ / search / GHSA-q6cq-8r4j-6rj5

GHSA-q6cq-8r4j-6rj5

Jenkins MathWorks Polyspace Plugin vulnerable to arbitrary file read

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-37960

Packages

EcosystemPackageAffectedFixed in
Maven com.mathworks.polyspace.jenkins:mathworks-polyspace <= 1.0.5 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier does not restrict the path of the attached files in Polyspace Notification post-build step. This allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file system.

References

External links from the advisory. They lead to third-party sites.