PT-2022-4017 · Jenkins · Jenkins Deployer Framework Plugin+1

Daniel Beck · Published 2022-07-27 · Updated 2023-11-22 · CVE-2022-36889

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jenkins Deployer Framework Plugin versions 85.v1d1888e8c021 and earlier

Description The issue is related to the incorrect restriction of the application path when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service. This can be exploited by a remote attacker to upload files.

Recommendations For Jenkins Deployer Framework Plugin versions 85.v1d1888e8c021 and earlier, consider restricting the application path of the applications when configuring a deployment to prevent attackers from uploading arbitrary files. As a temporary workaround, consider disabling the deployment configuration feature until a patch is available. Restrict access to the Item/Configure permission to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-04850

CVE-2022-36889

GHSA-J5QQ-6RPM-QJGH

Affected Products

Jenkins

Jenkins Deployer Framework Plugin

References · 9

• https://osv.dev/vulnerability/GHSA-j5qq-6rpm-qjgh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36889 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36889 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-07-27/#SECURITY-2764 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04850 · Security Note
• https://github.com/jenkinsci/deployer-framework-plugin · Note
• https://t.me/cvenotify/33855 · Telegram Post
• http://openwall.com/lists/oss-security/2022/07/27/1 · Note
• https://t.me/cibsecurity/47095 · Telegram Post