CVE-2022-23107
mediumpriority · track · 33EPSS 0.019 · 79 %ileEUUSEPSS · scored 2026-10-24
Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.5–8.1
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (9)
Products and version ranges known to be affected.
- jenkins warnings next generation9.0.0 → 9.0.2nvdUScpe:2.3:a:jenkins:warnings_next_generation:*:*:*:*:*:*:*:*
- jenkins warnings next generation9.10.0 → 9.10.2nvdUScpe:2.3:a:jenkins:warnings_next_generation:*:*:*:*:*:*:*:*
- jenkins warnings next generation9.5.0 → 9.5.2nvdUScpe:2.3:a:jenkins:warnings_next_generation:*:*:*:*:*:*:*:*
- jenkins warnings next generation= 9.7.0nvdUScpe:2.3:a:jenkins:warnings_next_generation:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-rvh4-g2rj-hr9cPath Traversal in Jenkins Warnings Next Generation Plugin2022-01-21ghsa · osvUS
Jenkins Warnings Next Generation Plugin prior to 9.10.3, 9.7.1, 9.5.2, and 9.0.2 does not restrict the name of a file when configuring a custom ID. This allows attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system. Jenkins Warnings Next Generation Plugin 9.10.3, 9.7.1, 9.5.2, and 9.0.2 checks for the presence of prohibited directory separator characters in the custom ID.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2022/01/12/6cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2022-23107cnnvd
- https://vigilance.fr/vulnerability/Jenkins-Plugins-multiple-vulnerabilities-37236cnnvd
- https://www.auscert.org.au/bulletins/ESB-2022.0196cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2022011320cnnvd
- https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2090cnnvd
- http://www.openwall.com/lists/oss-security/2022/01/12/6enisa_euvd
- https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2090enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan