CVE-2024-23900: Path traversal vulnerability in Jenkins Matrix Project Plugin

January 24, 2024

Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.

References

www.openwall.com/lists/oss-security/2024/01/24/6
github.com/advisories/GHSA-cjgm-9vc9-56mx
github.com/jenkinsci/matrix-project-plugin/commit/f7a5b24905f69896234da34250171c1be80cddb4
nvd.nist.gov/vuln/detail/CVE-2024-23900
www.jenkins.io/security/advisory/2024-01-24/

Code Behaviors & Features

Detect and mitigate CVE-2024-23900 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →