Vulnerability · Published Nov 15, 2022 · Assigned by jenkins
CVE-2022-45381
High 8.1
In plain English
A high-severity path traversal in Jenkins Pipeline Utility Steps Plugin from Jenkins project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:pipeline-utility-steps | 2.13.2 | GHSA-3g9q-cmgv-g4p6 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Jenkins project | Jenkins Pipeline Utility Steps Plugin | unspecified – through 2.13.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N