Skip to content
Sign in
Not rated

CVE-2022-34177 Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for…

Description

Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

Affected products and versions

Product Affected versions Fixed in
Jenkins Pipeline: Input Step Plugin 447.449 earliest → < 447.449.v193fd29f6021 447.449.v193fd29f6021
Jenkins Pipeline: Input Step Plugin 2.12 earliest → < 2.12.2 2.12.2

Other CVEs of Jenkins Pipeline: Input Step Plugin

The 2 CVEs of Jenkins Pipeline: Input Step Plugin →
CVE-2022-43407 Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally… 8.8 High
Track this CVE