Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

aendter.jenkins.plugins:filesystem-list-parameter-plugin

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3MavenPublished

    Jenkins Filesystem List Parameter Plugin has Path Traversal vulnerability

    CVE-2024-54004 · GHSA-fwxq-3f52-5cmc

    Affected
    • Maven aendter.jenkins.plugins:filesystem-list-parameter-plugin < 0.0.15
    Fixed in
    0.0.15· Vendor fix available
    Issue
    Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter. This allows attackers with Item/Configure permission to enumerate file names on the Jenkins controller file system. Filesystem List Parameter Plugin 0.0.15 ensures that paths used by the File system objects list Parameter are restricted to an allow list, with the default base directory set to $JENKINSHOME/userContent/. The allow list can be configured to include additional custom base directories.

    Recommended action: Upgrade to 0.0.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →