CVE-2022-25188
Last modified
CVE-2022-25188 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker.. EPSS estimates a 1.20% chance of exploitation in the next 30 days.
Description
Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Fortify | <= 20.2.34 |
References
- http://www.openwall.com/lists/oss-security/2022/02/15/2Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2214Issue Tracking, Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/02/15/2Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2214Issue Tracking, Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-25188?
How severe is CVE-2022-25188?
How do I fix CVE-2022-25188?
Are you affected by CVE-2022-25188?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST