CVE-2020-2277 - Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller

MEDIUM

Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller

Published Sep 16, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 1.66%

Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
unspecified	affected	<=1.0

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/09/16/3		mailing-listx_refsource_MLISTThird Party Advisory
https://github.com/advisories/GHSA-85wg-cg5p-m76p		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-2277
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1968%20%281%29		x_refsource_CONFIRM
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1968%20(1)