← Volver a CVEs

CVE-2022-45381

HIGH

8.1

Descripcion

Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.

Detalles CVE

Puntuacion CVSS v3.18.1

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado11/15/2022

Ultima modificacion4/30/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

jenkins:pipeline_utility_steps

Debilidades (CWE)

CWE-22CWE-22

Referencias

http://www.openwall.com/lists/oss-security/2022/11/15/4(jenkinsci-cert@googlegroups.com)

https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2949(jenkinsci-cert@googlegroups.com)

http://www.openwall.com/lists/oss-security/2022/11/15/4(af854a3a-2127-422b-91ae-364da2661108)

https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2949(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.