CVE-2022-25188

EUVD-2022-0753
Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
Affected Products (NVD)
VendorProductVersion
jenkinsfortify
𝑥
≤ 20.2.34
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2022/02/15/2
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2214
http://www.openwall.com/lists/oss-security/2022/02/15/2
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2214