Insecure File Access in Jenkins Pipeline Utility Steps Plugin from CloudBees
CVE-2022-45381

8.1HIGH

Key Information:

Vendor

Jenkins
Status
Jenkins Pipeline Utility Steps Plugin
Vendor
CVE Published:
15 November 2022

What is CVE-2022-45381?

The Jenkins Pipeline Utility Steps Plugin versions 2.13.1 and prior have a significant vulnerability due to inadequate restrictions on enabled prefix interpolators. This oversight allows attackers, who can configure Pipelines, to exploit the 'file:' prefix interpolator by default. Consequently, they may gain unauthorized access to read sensitive files from the underlying Jenkins controller file system, leading to potential data leaks and system breaches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Jenkins Pipeline Utility Steps Plugin <= 2.13.1

References

https://www.jenkins.io/security/advisory/2022-11-15/#SECU...
http://www.openwall.com/lists/oss-security/2022/11/15/4
mailing-list

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.