PT-2022-17143 · Jenkins · Jenkins Doktor Plugin+1

Daniel Beck · Published 2022-02-15 · Updated 2023-11-03 · CVE-2022-25204

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Doktor Plugin version 0.4.1 and earlier

Description The issue allows attackers who can control agent processes to determine whether a file with a given name exists on the controller, by exploiting the functionality that renders files as Markdown or Asciidoc and analyzing error messages.

Recommendations For Jenkins Doktor Plugin version 0.4.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-25204

GHSA-64Q9-F38H-9MWX

Affected Products

Jenkins

Jenkins Doktor Plugin

References · 5

• https://jenkins.io/security/advisory/2022-02-15/#SECURITY-2548 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25204 · Security Note
• https://osv.dev/vulnerability/GHSA-64q9-f38h-9mwx · Vendor Advisory
• https://github.com/jenkinsci/doktor-plugin · Note