8.1 High

CVE-2022-45381 Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and…

Description

Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Pipeline Utility Steps Plugin 2.13	earliest → 2.13.1	No fix stated

The 2 CVEs of Jenkins Pipeline Utility Steps Plugin →

CVE-2023-32981 An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers… 8.8 High

Do you use Jenkins Pipeline Utility Steps Plugin?

Track this CVE Watch Jenkins Pipeline Utility Steps Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2022-45381

Timeline

Published November 15, 2022
Last modified April 30, 2025

References

www.jenkins.io www.jenkins.io
[oss-security] 20221115 Multiple vulnerabilities in Jenkins plugins www.openwall.com

Track this CVE

CVE-2022-45381 Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and…

Description

Affected products and versions

Other CVEs of Jenkins Pipeline Utility Steps Plugin