CVE-2023-24449: 
Java vulnerability analysis and mitigation

CVE-2023-24449 affects the PWauth Security Realm Plugin version 0.4 and earlier in Jenkins. The vulnerability was discovered and reported by Kevin Guerroudj from CloudBees, Inc. and was publicly disclosed on January 24, 2023. This security issue impacts the form validation methods of the plugin (Jenkins Advisory).

The vulnerability is classified as a path traversal issue with a Medium severity rating (CVSS v3.1 Base Score: 4.3). The core issue lies in the plugin's failure to restrict file names in methods implementing form validation, which could allow unauthorized access to the Jenkins controller file system. The vulnerability is tracked as SECURITY-2985 in Jenkins security advisory system (NVD, Jenkins Advisory).

The vulnerability allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. This could potentially lead to unauthorized file system access and information disclosure (Jenkins Advisory).

As of the advisory publication date, no official fix was available for this vulnerability. Users of PWauth Security Realm Plugin version 0.4 and earlier should monitor for updates and implement additional access controls where possible (Jenkins Advisory).