PT-2022-15849 · Jenkins · Jenkins Warnings Next Generation Plugin+1

Kevin Guerroudj · Published 2022-01-12 · Updated 2023-11-15 · CVE-2022-23107

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Warnings Next Generation Plugin versions 9.10.2 and earlier

Description The issue allows attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system due to the lack of restriction on the name of a file when configuring custom ID.

Recommendations For Jenkins Warnings Next Generation Plugin versions 9.10.2 and earlier, update to version 9.10.3 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-23107

GHSA-RVH4-G2RJ-HR9C

Affected Products

Jenkins

Jenkins Warnings Next Generation Plugin

References · 12

• 🔥 https://github.com/CVEProject/cvelist/blob/36f932156733baab1b13868be4338de406a1dec7/2022/23xxx/CVE-2022-23107.json · Exploit
• https://jenkins.io/security/advisory/2022-01-12/#SECURITY-2090 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23107 · Security Note
• https://osv.dev/vulnerability/GHSA-rvh4-g2rj-hr9c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23107 · Vendor Advisory
• https://github.com/jenkinsci/warnings-ng-plugin/releases/tag/v9.10.3 · Note
• https://github.com/jenkinsci/warnings-ng-plugin · Note
• https://t.me/cvenotify/25608 · Telegram Post
• https://t.me/cvenotify/25355 · Telegram Post
• https://t.me/cibsecurity/35370 · Telegram Post
• https://t.me/cvenotify/25324 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/12/6 · Note