GHSA-9pqq-h9qv-28fp

ghsaUSosv

Jenkins Config Rotator Plugin vulnerable to path traversal

view advisory published 2022-11-16Licence: CC-BY-4.0

Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system. Currently there is no known workaround and no fix available.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-45388US	high7.5	1.17% (67th)	—	2022-11-15
Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2022/11/15/4WEB
https://github.com/jenkinsci/config-rotator-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2022-45388ADVISORY
https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2842WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan