CVE-2023-32981: 
Java vulnerability analysis and mitigation

CVE-2023-32981 is an arbitrary file write vulnerability discovered in Jenkins Pipeline Utility Steps Plugin versions 2.15.2 and earlier. The vulnerability was disclosed on May 16, 2023, affecting the untar and unzip Pipeline steps functionality that extracts archives into job workspaces (Jenkins Advisory).

The vulnerability exists because the Pipeline Utility Steps Plugin does not validate or limit file paths of files contained within archives when using the untar and unzip Pipeline steps. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

This vulnerability allows attackers who can provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content (Jenkins Advisory).

The vulnerability has been fixed in Pipeline Utility Steps Plugin version 2.15.3, which rejects extraction of files in tar and zip archives that would be placed outside the expected destination directory. Users are advised to upgrade to this version or later (Jenkins Advisory).