PT-2022-18290 · Jenkins · Jenkins Extended Choice Parameter Plugin+1

Oleg Nenashev · Published 2022-03-15 · Updated 2023-11-30 · CVE-2022-27203

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Extended Choice Parameter Plugin versions 346.vd87693c5a 86c and earlier

Description The issue allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.

Recommendations For Jenkins Extended Choice Parameter Plugin versions 346.vd87693c5a 86c and earlier, consider restricting the Item/Configure permission to minimize the risk of exploitation until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-27203

GHSA-CH63-6CMG-GWG2

Affected Products

Jenkins

Jenkins Extended Choice Parameter Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-ch63-6cmg-gwg2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27203 · Security Note
• https://jenkins.io/security/advisory/2022-03-15/#SECURITY-1351 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27203 · Vendor Advisory
• http://openwall.com/lists/oss-security/2022/03/15/2 · Note
• https://t.me/cvenotify/61767 · Telegram Post