Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 1.638Upgrade Jenkins LTS to version 1.625.2Upgrade Jenkins to the latest version | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade nodejs-expand-rangeUpgrade nodejs-kind-ofUpgrade nodejs-pinkieUpgrade nodejs-uuidUpgrade nodejs-nodemonUpgrade nodejs-readdirpUpgrade nodejs-slideUpgrade nodejs-undefsafeUpgrade nodejs-gotUpgrade nodejs-is-equal-shallowUpgrade nodejs-mkdirpUpgrade nodejs-lodash.isargumentsUpgrade nodejs-strip-json-commentsUpgrade nodejs-graceful-fsUpgrade nodejs-object.omitUpgrade activemqUpgrade nodejs-end-of-streamUpgrade nodejs-write-file-atomicUpgrade nodejs-lodash.isiterateecallUpgrade nodejs-repeat-elementUpgrade openshift-origin-broker-utilUpgrade nodejs-is-redirectUpgrade nodejs-url-parse-laxUpgrade nodejs-is-binary-pathUpgrade openshift-origin-cartridge-cronUpgrade nodejs-regex-cacheUpgrade openvswitchUpgrade nodejs-create-error-classUpgrade heapsterUpgrade nodejs-lodash.basecopyUpgrade nodejs-semverUpgrade nodejs-lodash.isarrayUpgrade nodejs-preserveUpgrade nodejs-lodash.createassignerUpgrade nodejs-splitUpgrade nodejs-arr-diffUpgrade openshift-origin-msg-node-mcollectiveUpgrade openshift-ansibleUpgrade nodejs-arrifyUpgrade nss_wrapperUpgrade nodejs-filename-regexUpgrade nodejs-lodash.defaultsUpgrade nodejs-touchUpgrade jenkinsUpgrade nodejs-configstoreUpgrade nodejs-is-streamUpgrade nodejs-pinkie-promiseUpgrade nodejs-is-dotfileUpgrade nodejs-anymatchUpgrade nodejs-iniUpgrade nodejs-read-all-streamUpgrade nodejs-deep-extendUpgrade nodejs-lazy-cacheUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-update-notifierUpgrade nodejs-glob-baseUpgrade openshift-enterprise-upgradeUpgrade nodejs-duplexifyUpgrade nodejs-pause-streamUpgrade nodejs-bracesUpgrade nodejs-normalize-pathUpgrade nodejs-extglobUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-lodash.getnativeUpgrade origin-kibanaUpgrade nodejs-for-inUpgrade nodejs-for-ownUpgrade nodejs-optimistUpgrade nodejs-rcUpgrade nodejs-error-exUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-glob-parentUpgrade nodejs-arr-flattenUpgrade nodejs-fill-rangeUpgrade nodejs-throughUpgrade nodejs-is-plain-objUpgrade nodejs-randomaticUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-parse-globUpgrade rhcUpgrade nodejs-osenvUpgrade nodejs-is-npmUpgrade nodejs-es6-promiseUpgrade nodejs-object-assignUpgrade nodejs-lodash.assignUpgrade nodejs-lodash.restparamUpgrade nodejs-binary-extensionsUpgrade nodejs-expand-bracketsUpgrade nodejs-fromUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-registry-urlUpgrade openshift-origin-cartridge-phpUpgrade nodejs-lodash.baseassignUpgrade nodejs-parse-jsonUpgrade nodejs-event-streamUpgrade nodejs-unzip-responseUpgrade nodejs-xdg-basedirUpgrade nodejs-ps-treeUpgrade nodejs-lodash.keysUpgrade nodejs-ansi-greenUpgrade nodejs-string-lengthUpgrade nodejs-latest-versionUpgrade nodejs-prepend-httpUpgrade nodejs-duplexerUpgrade nodejs-micromatchUpgrade nodejs-ansi-wrapUpgrade atomic-openshiftUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-stream-combinerUpgrade rubygem-openshift-origin-commonUpgrade nodejs-os-tmpdirUpgrade nodejs-array-uniqueUpgrade nodejs-chokidarUpgrade phpUpgrade nodejs-node-status-codesUpgrade nodejs-lowercase-keysUpgrade nodejs-is-extendableUpgrade nodejs-is-numberUpgrade nodejs-align-textUpgrade nodejs-is-primitiveUpgrade nodejs-os-homedirUpgrade nodejs-is-extglobUpgrade nodejs-is-globUpgrade nodejs-package-jsonUpgrade rubygem-openshift-origin-controllerUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-async-eachUpgrade nodejs-isobjectUpgrade nodejs-map-streamUpgrade nodejs-timed-outUpgrade openshift-origin-node-proxyUpgrade nodejs-semver-diffUpgrade nodejs-capture-stack-traceUpgrade openshift-origin-node-utilUpgrade nodejs-success-symbol | Jun 18, 2018 | Nov 11, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub