In short
- CVE-2023-24449 is a MEDIUM (CVSS 4.3) vulnerability affecting org.jvnet.hudson.plugins:pwauth, pwauth security realm (jenkins).
- Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.2% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
Description
Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
NVD description
Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free