CVE-2023-2196

Name of the Vulnerable Software and Affected Versions Jenkins Code Dx Plugin versions 3.1.0 and earlier

Description A missing permission check in the plugin allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on an agent file system. This issue arises from a method implementing form validation that does not perform a permission check, enabling attackers to exploit this weakness. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For Jenkins Code Dx Plugin versions 3.1.0 and earlier, update to version 4.0.0 or later, which requires Item/Configure permission for the form validation method and ensures that only files located within the workspace can be checked.