Description
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.
Remediation
References
Related Vulnerabilities
WeBid Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3815)
MySQL CVE-2012-0485 Vulnerability (CVE-2012-0485)
WebLogic CVE-2023-21964 Vulnerability (CVE-2023-21964)
TYPO3 Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2013-4321)
IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-1606)