PT-2022-4014 · Jenkins · Jenkins Files Found Trigger Plugin+1

Daniel Beck · Published 2022-07-27 · Updated 2023-11-22 · CVE-2022-36914

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Files Found Trigger Plugin versions 1.5 and earlier

Description The issue is related to insufficient authorization procedures in the plugin. This allows a remote attacker to gain unauthorized access to protected information. Specifically, the plugin does not perform a permission check in a method implementing form validation, enabling attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. This can be exploited to effectively list the Jenkins controller file system by sending a sequence of requests.

Recommendations For Jenkins Files Found Trigger Plugin versions 1.5 and earlier, as a temporary workaround, consider disabling the form validation method until a patch is available. Restrict access to the plugin to minimize the risk of exploitation. Avoid using the plugin to check for file paths on the Jenkins controller file system until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2022-04847

CVE-2022-36914

GHSA-JJ8J-6JQ7-GMVH

Affected Products

Jenkins

Jenkins Files Found Trigger Plugin

References · 7

• https://osv.dev/vulnerability/GHSA-jj8j-6jq7-gmvh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36914 · Security Note
• https://bdu.fstec.ru/vul/2022-04847 · Security Note
• https://jenkins.io/security/advisory/2022-07-27/#SECURITY-2210 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36914 · Vendor Advisory
• https://t.me/cibsecurity/47076 · Telegram Post
• http://openwall.com/lists/oss-security/2022/07/27/1 · Note