| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.main:config-rotator | ≤ 2.0.1 | |
| config rotator | ≤ 2.0.1 |
Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system. Currently there is no known workaround and no fix available.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free