PT-2022-18288 · Jenkins · Jenkins Lts+2

Daniel Beck · Published 2022-03-15 · Updated 2023-11-22 · CVE-2022-27201

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Semantic Versioning Plugin versions 1.13 and earlier Jenkins versions 2.318 and earlier Jenkins LTS versions 2.303.2 and earlier

Description The issue allows attackers to control agent processes and have Jenkins parse a crafted file, using external entities for extraction of secrets from the Jenkins controller or server-side request forgery. This is due to the lack of restrictions on the execution of controller/agent messages and file path limitations. The XML parser is not configured to prevent XML external entity (XXE) attacks.

Recommendations For Jenkins Semantic Versioning Plugin versions 1.13 and earlier, update to a version later than 1.13 to resolve the issue. For Jenkins versions 2.318 and earlier, update to a version later than 2.318. For Jenkins LTS versions 2.303.2 and earlier, update to Jenkins LTS 2.303.3 or later, following the LTS upgrade guide.

Fix

SSRF

XXE

Weakness Enumeration

CWE-918

CWE-611

Related Identifiers

CVE-2022-27201

GHSA-X3M3-G8W6-MF28

Affected Products

Jenkins

Jenkins Lts

Jenkins Semantic Versioning Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-27201 · Security Note
• https://jenkins.io/security/advisory/2022-03-15/#SECURITY-2124 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27201 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x3m3-g8w6-mf28 · Vendor Advisory
• https://github.com/jenkinsci/semantic-versioning-plugin · Note
• http://openwall.com/lists/oss-security/2022/03/15/2 · Note