CVE-2023-35147

Name of the Vulnerable Software and Affected Versions Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier

Description The issue allows attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system due to the lack of restriction on the AWS SQS queue name path parameter in an HTTP endpoint.

Recommendations For Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier, consider restricting access to the HTTP endpoint until a patch is available. As a temporary workaround, restrict the Item/Read permission to minimize the risk of exploitation.