File Access Vulnerability in Jenkins Warnings Next Generation Plugin by Jenkins

CVE-2022-23107

Summary

The Warnings Next Generation Plugin for Jenkins, specifically version 9.10.2 and earlier, contains a file access vulnerability that enables attackers with Item/Configure permission to manipulate files on the Jenkins controller. By exploiting this weakness, attackers can read and write to specific files with a predetermined suffix, potentially compromising the integrity and confidentiality of the Jenkins file system. This flaw underscores the importance of implementing strict access controls and file name restrictions to protect sensitive data within Jenkins.

References