| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:deployer-framework | < 86.v7b_a_4a_55b_f3ec | 86.v7b_a_4a_55b_f3ec |
| deployer framework | ≤ 85.v1d1888e8c021 |
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation.
This allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Deployer Framework Plugin 86.v7b_a_4a_55b_f3ec ensures that only files contained inside the expected directory can be accessed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free