Directory Traversal Vulnerability in Jenkins Folders Plugin

CVE-2023-40338

Summary

The Jenkins Folders Plugin, specifically version 6.846.v23698686f0f6 and earlier, exhibits a vulnerability that results in the exposure of sensitive system information. When users attempt to access the Scan Organization Folder Log in the absence of available logs, an error message is displayed that inadvertently reveals the absolute path of a log file. This unintentional information leak can provide attackers with insights into the Jenkins controller's file system structure, potentially facilitating further exploitation.

References