Insecure File Access in Jenkins Pipeline Utility Steps Plugin from CloudBees
CVE-2022-45381

8.1HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Pipeline Utility Steps Plugin
Vendor
CVE Published:
15 November 2022

Summary

The Jenkins Pipeline Utility Steps Plugin versions 2.13.1 and prior have a significant vulnerability due to inadequate restrictions on enabled prefix interpolators. This oversight allows attackers, who can configure Pipelines, to exploit the 'file:' prefix interpolator by default. Consequently, they may gain unauthorized access to read sensitive files from the underlying Jenkins controller file system, leading to potential data leaks and system breaches.

Affected Version(s)

Jenkins Pipeline Utility Steps Plugin <= 2.13.1

References

https://www.jenkins.io/security/advisory/2022-11-15/#SECU...
http://www.openwall.com/lists/oss-security/2022/11/15/4
mailing-list

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.