Jenkins Project · Jenkins Sidebar Link Plugin
The Jenkins Sidebar Link Plugin, version 2.2.1 and earlier, contains a path traversal flaw in a form validation method that fails to restrict the paths of files it handles. An attacker with Overall/Read permission on the Jenkins controller can exploit this over the network with low complexity and no user interaction, using it to check whether an arbitrary attacker-specified file path exists on the controller's file system.
Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Disclosed on 16 May 2023. No public exploit code or confirmed exploitation is recorded.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: org.jenkins-ci.plugins:sidebar-link.
Upgrade to 2.2.2 or later
Set the version to 2.2.2 or later in your pom.xml or build.gradle.
The first fix for CVE-2023-32985. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 2.2.2 | 2.2.2 |
“Up to” means the second version is the fix and is not affected.