GitHub Advisoryadvisory · Maven

GHSA-f7fq-wp2x-jc25 Jenkins WildFly Deployer Plugin vulnerable to path traversal

MEDIUM Published 2022-09-22 Modified 2022-12-09 Official page ↗
Aliases
CVE-2022-41235
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:wildfly-deployer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22, CWE-284, CWE-693
Reviewed
2022-09-23

Affected packages

• Maven org.jenkins-ci.plugins:wildfly-deployer: <= 1.0.2 (no fix yet)

Description

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system. This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

Related

Alias · CVE (1)

  • CVE-2022-41235 Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the… vulnerability

Weakness · CWE (3)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-284 Improper Access Control weakness
  • CWE-693 Protection Mechanism Failure weakness

References