PT-2022-22049 · Jenkins · Jenkins Junit Plugin+1

Daniel Beck · Published 2022-06-22 · Updated 2023-11-03 · CVE-2022-34181

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins xUnit Plugin versions 3.0.8 and earlier

Description The issue allows attackers who can control agent processes to create an arbitrary directory on the Jenkins controller or to obtain test results from existing files in an attacker-specified directory. This is due to the implementation of an agent-to-controller message that creates a user-specified directory if it doesn't exist and parses files inside it as test results.

Recommendations For Jenkins xUnit Plugin versions 3.0.8 and earlier, update to version 3.1.0 or later, which changes the message type from agent-to-controller to controller-to-agent, preventing execution on the controller.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2022-34181

GHSA-298J-9Q4W-6RM4

Affected Products

Jenkins

Jenkins Junit Plugin

References · 6

• https://jenkins.io/security/advisory/2022-06-22/#SECURITY-2549 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34181 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-298j-9q4w-6rm4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34181 · Security Note
• https://github.com/jenkinsci/xunit-plugin/commit/6976b5da114845a7936ea36d5783a65cd91f9897 · Note
• https://github.com/jenkinsci/xunit-plugin · Note