CVE-2018-1000607 - A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins master process is running as

Back Back to CVE browser

MEDIUM

A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins master process is running as

Published Jun 26, 2018

6.5

MEDIUM

CVSS 3.0

EPSS 0.85%

Description

A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rulepack zip file contents to overwrite any file on the Jenkins master file system, only limited by the permissions of the user the Jenkins master process is running as.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (3)

https://github.com/advisories/GHSA-8864-pwhg-3mp2
Advisory
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-870
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000607

Link	Providers	Tags
https://github.com/advisories/GHSA-8864-pwhg-3mp2		Advisory
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-870		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000607