Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-54004
CVE-2024-54004:
Java vulnerability analysis and mitigation
Overview
The Filesystem List Parameter Plugin for Jenkins, versions 0.0.14 and earlier, contains a path traversal vulnerability (CVE-2024-54004) that was disclosed on November 27, 2024. This security flaw affects the File system objects list Parameter functionality within the plugin, impacting Jenkins installations using the vulnerable versions (Jenkins Advisory, NVD).
Technical details
The vulnerability is classified as a path traversal issue (CWE-22) with a CVSS v3.1 base score of 4.3 (Medium). The security flaw stems from the plugin's failure to properly restrict the path used for the File system objects list Parameter, which could allow unauthorized access to file system information (Jenkins Advisory, CISA-ADP).
Impact
When exploited, this vulnerability allows attackers with Item/Configure permission to enumerate file names on the Jenkins controller file system. This could potentially expose sensitive information about the file system structure and contents to unauthorized users (Jenkins Advisory, GBHackers).
Mitigation and workarounds
The vulnerability has been patched in Filesystem List Parameter Plugin version 0.0.15. The fix implements path restrictions using an allow list, with the default base directory set to $JENKINS_HOME/userContent/. Administrators can configure additional custom base directories as needed. Users are strongly advised to upgrade to version 0.0.15 to address this security issue (Jenkins Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management