CVE-2024-28151: Jenkins HTML Publisher Plugin Path traversal vulnerability

March 6, 2024 (updated October 31, 2024)

Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to access it.

References

github.com/advisories/GHSA-478x-m3mx-7j3f
github.com/jenkinsci/htmlpublisher-plugin
github.com/jenkinsci/htmlpublisher-plugin/commit/6b840248dd0d691bbac9b515cd750b3f925909b2
nvd.nist.gov/vuln/detail/CVE-2024-28151
www.jenkins.io/security/advisory/2024-03-06/

Detect and mitigate CVE-2024-28151 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →