CVE-2022-36889

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.

• CWE-22

• http://www.openwall.com/lists/oss-security/2022/07/27/1Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2764Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/07/27/1Mailing List, Third Party Advisory
• https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2764Vendor Advisory

Published

Jul 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36883A missing permission check in Jenkins Git Plugin 4.11.3 and …7.5
• CVE-2022-36884The webhook endpoint in Jenkins Git Plugin 4.11.3 and earlie…5.3
• CVE-2022-36885Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant…5.3
• CVE-2022-36886A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
• CVE-2022-36887A cross-site request forgery (CSRF) vulnerability in Jenkins…4.3
• CVE-2022-36888A missing permission check in Jenkins HashiCorp Vault Plugin…6.5
• CVE-2022-3689The HTML Forms WordPress plugin before 1.3.25 does not prope…7.2
• CVE-2022-36890Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earli…4.3
• CVE-2022-36891A missing permission check in Jenkins Deployer Framework Plu…4.3
• CVE-2022-36892Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not per…4.3
• CVE-2022-36893Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not per…4.3
• CVE-2022-36894An arbitrary file write vulnerability in Jenkins CLIF Perfor…6.5