PT-2022-22046 · Jenkins · Jenkins Embeddable Build Status Plugin+1

Published 2022-06-22 · Updated 2023-11-03 · CVE-2022-34179

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Embeddable Build Status Plugin versions 2.0.3 and earlier

Description The issue allows attackers without Overall/Read permission to specify paths to other SVG images on the Jenkins controller file system by exploiting a relative path traversal vulnerability. This is possible because the style query parameter, used to choose a different SVG image style, does not restrict possible values.

Recommendations For Jenkins Embeddable Build Status Plugin versions 2.0.3 and earlier, update to version 2.0.4 or later, which restricts the style query parameter to one of the three legal values.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-34179

GHSA-93MX-2VF9-28C4

Affected Products

Jenkins

Jenkins Embeddable Build Status Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-34179 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34179 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-93mx-2vf9-28c4 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-06-22/#SECURITY-2792 · Vendor Advisory
• https://github.com/jenkinsci/embeddable-build-status-plugin · Note
• https://github.com/jenkinsci/embeddable-build-status-plugin/commit/63f82f28d989d30a23089a0a66c11f222651a8c6 · Note