CVE-2023-41932

Root

Cause

The Jenkins Job Configuration History Plugin, in versions 1227.v7a_79fc4dc01f and earlier, does not properly restrict the timestamp query parameter across multiple endpoints. This lack of validation allows an attacker to specify arbitrary directory paths on the Jenkins controller file system [1][3].

Exploitation

To exploit this vulnerability, an attacker must have the Job Config History/DeleteEntry permission [1]. By manipulating the timestamp parameter, the attacker can direct the plugin to attempt deletion of a directory, provided that directory contains a file named history.xml [2][3]. This condition limits the attack to specific directories but can still lead to targeted deletion.

Impact

Successful exploitation enables an attacker to delete attacker-specified directories on the Jenkins controller file system. This could result in data loss or service disruption, depending on the directories affected. The issue has been assigned a CVSS severity of High [1][2].

Mitigation

The vulnerability is fixed in Job Configuration History Plugin version 1229.v3039470161a_d [1][2]. Users are advised to update to this version or later. No workarounds have been provided by the vendor.