Jenkins Redpen - Pipeline Reporter for Jira Plugin Path Traversal Vulnerability

A path traversal vulnerability has been identified in the Redpen - Pipeline Reporter for Jira Plugin, specifically in versions through 1.054.v7b_9517b_6b_202. The vulnerability arises because the plugin fails to properly validate the workspace directory path when uploading artifacts to Jira. This issue allows attackers with Item/Configure permission to access files in the Jenkins controller's workspace directory. The vulnerability is exacerbated by the fact that the plugin does not support distributed builds, leading to artifact uploads from the Jenkins controller instead of the agent performing the build.

Impact

Exploitation of this vulnerability allows for unauthorized access to files in the Jenkins controller's workspace directory.