CVE-2023-3315

Name of the Vulnerable Software and Affected Versions Jenkins Team Concert Plugin versions 2.4.1 and earlier

Description The issue is related to missing permission checks in the Jenkins Team Concert Plugin, which allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. This is possible due to the lack of permission checks in methods implementing form validation.

Recommendations For Jenkins Team Concert Plugin versions 2.4.1 and earlier, update to version 2.4.2 or later, which requires Overall/Administer permission for the affected form validation methods. As a temporary workaround, consider restricting access to the form validation methods to minimize the risk of exploitation.