Relative Path Traversal Vulnerability in Jenkins Embeddable Build Status Plugin

CVE-2022-34179

What is CVE-2022-34179?

The Jenkins Embeddable Build Status Plugin versions up to 2.0.3 is susceptible to a relative path traversal vulnerability. This issue arises from the lack of restrictions on the style query parameter, which allows attackers to specify arbitrary paths to SVG images on the Jenkins controller file system. Importantly, this vulnerability can be exploited by users who lack Overall/Read permissions, enabling unauthorized access and manipulation of files on the system.

References