| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:codedx | < 4.0.0 | 4.0.0 |
| code dx | ≤ 3.1.0 |
Jenkins Code Dx Plugin 3.1.0 and earlier does not perform a permission check in a method implementing form validation.
This allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on an agent file system.
Code Dx Plugin 4.0.0 requires Item/Configure permission for this form validation method and ensures that only files located within the workspace can be checked.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free