CVE-2023-32986: 
Java vulnerability analysis and mitigation

The Jenkins File Parameter Plugin version 285.v757c5b67ac25 and earlier contains a critical security vulnerability identified as CVE-2023-32986. The vulnerability was discovered on May 16, 2023, and allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content (Jenkins Advisory).

The vulnerability stems from the plugin's failure to restrict the name (and resulting uploaded file name) of Stashed File Parameters. This implementation flaw allows attackers to manipulate file paths without proper validation, enabling them to write files to arbitrary locations on the Jenkins controller file system. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content. This could lead to system compromise through arbitrary file writes, potentially affecting the confidentiality, integrity, and availability of the Jenkins system (GitHub Lab).

The vulnerability has been fixed in File Parameter Plugin version 285.287.v4b7b29d3469d. Users are strongly advised to update to this version, which implements proper restrictions on the name and resulting uploaded file name of Stashed File Parameters (Jenkins Advisory).