PT-2022-25752 · Jenkins · Jenkins Dotci Plugin+1

Published 2022-09-21 · Updated 2025-05-28 · CVE-2022-41237

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins DotCi Plugin versions 2.40.00 and earlier

Description The issue arises from the Jenkins DotCi Plugin not configuring its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability. This vulnerability is exploitable by attackers who can modify .ci.yml files in SCM.

Recommendations For Jenkins DotCi Plugin versions 2.40.00 and earlier, consider disabling the plugin until a patch is available to prevent remote code execution. Restrict access to modify .ci.yml files in SCM to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-41237

GHSA-X3JJ-RGW9-7R5G

Affected Products

Jenkins

Jenkins Dotci Plugin

References · 9

• https://osv.dev/vulnerability/CVE-2022-41237 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-09-21/#SECURITY-1737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41237 · Security Note
• https://osv.dev/vulnerability/GHSA-x3jj-rgw9-7r5g · Vendor Advisory
• https://github.com/jenkinsci/DotCi · Note
• https://plugins.jenkins.io/DotCi · Note
• https://t.me/cibsecurity/50209 · Telegram Post
• https://jenkins.io/security/plugins/#suspensions · Note
• https://t.me/cvenotify/123870 · Telegram Post