Moderate severityNVD Advisory· Published Mar 6, 2024· Updated Feb 13, 2025

CVE-2024-28151

Description

Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to access it.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:htmlpublisherMaven	< 1.32.1	1.32.1

Affected products

ghsa-coords
pkg:maven/org.jenkins-ci.plugins/htmlpublisher
Range: < 1.32.1
Jenkins Project/S3 publisher Plugincpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-478x-m3mx-7j3fghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-28151ghsaADVISORY
www.jenkins.io/security/advisory/2024-03-06/ghsavendor-advisoryWEB
www.openwall.com/lists/oss-security/2024/03/06/3ghsaWEB
github.com/jenkinsci/htmlpublisher-plugin/commit/6b840248dd0d691bbac9b515cd750b3f925909b2ghsaWEB

News mentions

Jenkins Security Advisory 2024-03-06
Jenkins Security Advisories · Mar 6, 2024

cvss	0.260
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000