CVE-2022-29051: Missing permission checks in Jenkins Publish Over FTP Plugin
Summary
CVE-2022-29051: Missing permission checks in Jenkins Publish Over FTP Plugin. Affects org.jenkins-ci.plugins:publish-over-ftp versions < 1.17. Fixed in 1.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Publish Over FTP Plugin is a Maven package that provides functionality for connecting to FTP servers and transferring files. It is commonly used in Jenkins CI/CD pipelines to deploy artifacts or transfer files to remote servers. This plugin allows users to configure FTP server settings and credentials within Jenkins and perform file transfers as part of their build process.
Vulnerability Detail
The Jenkins Publish Over FTP Plugin prior to version 1.17 suffers from missing permission checks. This means that attackers with Overall/Read permission in Jenkins can connect to an FTP server using their own specified credentials, bypassing any authentication or authorization mechanisms in place. This vulnerability can be exploited by an attacker to gain unauthorized access to FTP servers and potentially perform malicious actions, such as modifying or deleting files on the server.
How To Fix
Latest published version: 261.v87f1561f44a_8 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the Overall/Read permission in Jenkins to trusted individuals only. By limiting access to this permission, the risk of unauthorized access to FTP servers through the plugin can be mitigated. However, this workaround may impact legitimate users who require Overall/Read permission for other tasks within Jenkins.
Conclusion
The missing permission checks in the Jenkins Publish Over FTP Plugin prior to version 1.17 can lead to unauthorized access to FTP servers. Users should upgrade to the latest version of the plugin to mitigate this vulnerability. Restricting the Overall/Read permission in Jenkins to trusted individuals can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:publish-over-ftp →
FAQ
This vulnerability allows attackers with Overall/Read permission in Jenkins to connect to FTP servers using their own credentials. They can potentially perform unauthorized actions on the server, such as modifying or deleting files.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply enter your Jenkins instance's pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fix to prevent potential unauthorized access to FTP servers.
As a temporary workaround, you can restrict the Overall/Read permission in Jenkins to trusted individuals only. This can help mitigate the risk of unauthorized access to FTP servers through the plugin. However, it is strongly recommended to upgrade to the latest version of the plugin to fully address the vulnerability.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-5pv7-hx9m-8jh3 (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-5pv7-hx9m-8jh3/GHSA-5pv7-hx9m-8jh3.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:publish-over-ftp.
