CVE-2024-5273

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors on the controller file system by editing the workspace path.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Jenkins Project	Jenkins Report Info Plugin	<= 1.2

References

http://www.openwall.com/lists/oss-security/2024/05/24/2Mailing List
https://www.jenkins.io/security/advisory/2024-05-24/#SECURITY-3070Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/05/24/2Mailing List
https://www.jenkins.io/security/advisory/2024-05-24/#SECURITY-3070Vendor Advisory

Timeline

Published: May 24, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-527329.1Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused.CVE-2024-527398.0D-LINK DI-8400 v16.07.26A1 was discovered to contain multiple remote command execution (RCE) vulnerabilities in the msp_info_htm function vi CVE-2024-52749.6Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra CVE-2024-52757.8A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be rea CVE-2024-527544.9D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the fn parameter in the tgfile_htm function.CVE-2024-527554.9D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the host_ip parameter in the ipsec_road_asp function.CVE-2024-527574.9D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the notify parameter in the arp_sys_asp function.CVE-2024-527599.8D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the ip parameter in the ip_position_asp function.CVE-2024-52769.1A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creatio CVE-2024-527625.4A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arb CVE-2024-527635.4A cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows attackers to execute CVE-2024-527659.8H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter.