CVE-2022-23107: Path Traversal in Jenkins Warnings Next Generation Plugin
Summary
CVE-2022-23107: Path Traversal in Jenkins Warnings Next Generation Plugin. Affects io.jenkins.plugins:warnings-ng across 4 version ranges.
< 9.0.2
>= 9.1.0, < 9.5.2
>= 9.6.0, < 9.7.1
>= 9.8.0, < 9.10.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Warnings Next Generation Plugin is a Maven-based package that provides functionality for managing warnings in Jenkins. It allows users to configure custom IDs for files, which can be used to write and read specific files on the Jenkins controller file system. This plugin is vulnerable to a path traversal attack, where an attacker with Item/Configure permission can manipulate the file name and access unauthorized files on the system.
Vulnerability Detail
The vulnerability in the Jenkins Warnings Next Generation Plugin arises from the lack of restrictions on the file name when configuring a custom ID. This allows an attacker to traverse the file system and access sensitive files on the Jenkins controller. By exploiting this vulnerability, an attacker can potentially read or modify files that they should not have access to, leading to unauthorized disclosure of information or unauthorized modifications to the system. The plugin has been fixed in versions 9.10.3, 9.7.1, 9.5.2, and 9.0.2 by implementing checks for prohibited directory separator characters in the custom ID.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 9.0.29.0.2 -
>= 9.1.0, < 9.5.29.5.2 -
>= 9.6.0, < 9.7.19.7.1 -
>= 9.8.0, < 9.10.39.10.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the plugin to the fixed versions as soon as possible.
Conclusion
The Jenkins Warnings Next Generation Plugin is vulnerable to a path traversal attack that allows unauthorized access to sensitive files on the Jenkins controller. It is crucial to update the plugin to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:warnings-ng →
FAQ
This vulnerability allows an attacker to read or modify sensitive files on the Jenkins controller. The impact can range from unauthorized disclosure of information to unauthorized modifications to the system.
Users of the Jenkins Warnings Next Generation Plugin prior to versions 9.10.3, 9.7.1, 9.5.2, and 9.0.2 are affected by this vulnerability.
There are no known public exploits for this vulnerability at the moment.
No, this vulnerability requires an attacker to have Item/Configure permission on the Jenkins instance.
Yes, the CVSS score for this vulnerability is 8.1 (High).
Related vulnerabilities
Recent vulnerabilities recorded for io.jenkins.plugins:warnings-ng.
