| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:matrix-project | < 822.824.v14451b | 822.824.v14451b |
| matrix project | ≤ 822.v01b_8c85d16d2 |
Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint.
This allows attackers with Item/Configure permission to create or replace any config.xml file on the Jenkins controller file system with content not controllable by the attackers.
Matrix Project Plugin 822.824.v14451b_c0fd42 sanitizes user-defined axis names of Multi-configuration project.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free