GHSA-9pqq-h9qv-28fp

Jenkins Config Rotator Plugin vulnerable to path traversal

Source: GitHub Advisory Database (reviewed) High CVE-2022-45388

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:config-rotator	<= 2.0.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system. Currently there is no known workaround and no fix available.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-45388 advisory
https://github.com/jenkinsci/config-rotator-plugin package
https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2842 web
http://www.openwall.com/lists/oss-security/2022/11/15/4 web