Not rated
CVE-2022-36889 Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the…
Description
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Deployer Framework Plugin 85 | earliest → 85.v1d1888e8c021 | No fix stated |
| Jenkins Deployer Framework Plugin 1.3 | earliest → < 1.3.1 | 1.3.1 |
Other CVEs of Jenkins Deployer Framework Plugin
The 4 CVEs of Jenkins Deployer Framework Plugin →
CVE-2022-36891
A missing permission check in Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier allows attackers with…
Not rated
CVE-2022-36890
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods…
Not rated
CVE-2020-2227
Jenkins Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page, resulting in…
Not rated