CVE Catalog
CVE-2023-3315
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.41%
33th percentile - higher than 33% of all known CVEs
Summary
Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of a specified file path on the Jenkins controller file system.
Risk Assessment
Attackers may gain information about the file system structure, potentially leading to further attacks on the system.
Recommendation
It is recommended to update the plugin to the latest version to mitigate the security vulnerability.
Original NVD description (English source)
Missing permission checks in Jenkins Team Concert Plugin 2.4.1 and earlier allow attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.