| Package | Affected versions | Patched versions |
|---|---|---|
| org.jvnet.hudson.plugins:pwauth | ≤ 0.4 | |
| pwauth security realm | ≤ 0.4 |
Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free