GHSA-23h5-8ph6-7rfc
GitHub Security Advisory
Path traversal vulnerability in Jenkins Fortify Plugin
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the `appName` and `appVersion` parameters of its Pipeline steps, which are used to write to files inside build directories.
This allows attackers with Item/Configure permission to write or overwrite `.xml` files on the Jenkins controller file system with content not controllable by the attacker.
Jenkins Fortify Plugin 20.2.35 sanitizes the `appName` and `appVersion` parameters of its Pipeline steps when determining the resulting filename.
Affected Packages
Maven
org.jenkins-ci.plugins:fortify
Affected versions:
0
(fixed in 20.2.35)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: July 5, 2025 6:26 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.