Jenkins MathWorks Polyspace Plugin vulnerable to arbitrary file read
Moderate severity
GitHub Reviewed
Published
Jul 12, 2023
to the GitHub Advisory Database
•
Updated Nov 8, 2023
Package
Affected versions
<= 1.0.5
Patched versions
None
Description
Published by the National Vulnerability Database
Jul 12, 2023
Published to the GitHub Advisory Database
Jul 12, 2023
Reviewed
Jul 12, 2023
Last updated
Nov 8, 2023
Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier does not restrict the path of the attached files in Polyspace Notification post-build step.
This allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file system.
References