GHSA-xcrr-x93h-rv4v
Arbitrary file deletion vulnerability in Jenkins Scriptler Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:scriptler | <= 342.v6a | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins Scriptler Plugin 342.v6a_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attackers with Scriptler/Configure permission to delete arbitrary files on the Jenkins controller file system.
References
External links from the advisory. They lead to third-party sites.