Description

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors on the controller file system by editing the workspace path.

Classification

CVE ID: CVE-2024-5273

Affected Products

Vendor: Jenkins Project

Product: Jenkins Report Info Plugin

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 13.16% (scored less or equal to compared to others)

EPSS Date: 2025-03-14 (when was this score calculated)

References

https://www.jenkins.io/security/advisory/2024-05-24/#SECURITY-3070
http://www.openwall.com/lists/oss-security/2024/05/24/2

Timeline