PT-2022-17128 · Jenkins · Jenkins Fortify Plugin+1

Matt Sicker · Published 2022-02-15 · Updated 2023-11-30 · CVE-2022-25188

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Fortify Plugin versions 20.2.34 and earlier

Description The issue allows attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system. This is due to the lack of sanitization of the appName and appVersion parameters in the Pipeline steps. The attackers cannot control the content of the files.

Recommendations For versions 20.2.34 and earlier, update to version 20.2.35 or later, which sanitizes the appName and appVersion parameters of its Pipeline steps.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-25188

GHSA-23H5-8PH6-7RFC

Affected Products

Jenkins

Jenkins Fortify Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2022-25188 · Security Note
• https://jenkins.io/security/advisory/2022-02-15/#SECURITY-2214 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25188 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-23h5-8ph6-7rfc · Vendor Advisory
• https://github.com/jenkinsci/fortify-plugin · Note
• https://github.com/jenkinsci/fortify-plugin/commit/ba3030cb63bb86b6bb13342664e0e319f2fee374 · Note
• http://openwall.com/lists/oss-security/2022/02/15/2 · Note
• https://t.me/cvenotify/26820 · Telegram Post
• https://t.me/cvenotify/61765 · Telegram Post