description: Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system.
affected:
{
defaultStatus: unknown
product: Jenkins AWS CodeCommit Trigger Plugin
vendor: Jenkins Project
versions:
lessThanOrEqual: 3.0.12, status: affected, version: 0, versionType: maven
}