PT-2022-26899 · Jenkins · Jenkins Junit Plugin+1

Daniel Beck · Published 2022-10-19 · Updated 2023-11-01 · CVE-2022-43414

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins NUnit Plugin versions 0.27 and earlier

Description The issue allows attackers who can control agent processes to obtain test results from files in an attacker-specified directory on the Jenkins controller. This is due to the implementation of an agent-to-controller message that parses files inside a user-specified directory as test results.

Recommendations For Jenkins NUnit Plugin versions 0.27 and earlier, update to version 0.28 or later, which changes the message type from agent-to-controller to controller-to-agent, preventing execution on the controller.

Fix

Protection Mechanism Failure

Files Accessible to External Parties

Weakness Enumeration

CWE-693

CWE-552

Related Identifiers

CVE-2022-43414

GHSA-8CXW-WVHC-P4X4

Affected Products

Jenkins

Jenkins Junit Plugin

References · 8

• https://jenkins.io/security/advisory/2022-10-19/#SECURITY-2551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43414 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43414 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8cxw-wvhc-p4x4 · Vendor Advisory
• https://github.com/jenkinsci/nunit-plugin/commit/e97a5aa804019ab345f50014f56ece23882c7475 · Note
• https://t.me/cibsecurity/51808 · Telegram Post
• http://openwall.com/lists/oss-security/2022/10/19/3 · Note
• https://t.me/cvenotify/60332 · Telegram Post