~ / search / GHSA-ch63-6cmg-gwg2

GHSA-ch63-6cmg-gwg2

Arbitrary JSON and property file read vulnerability in Jenkins Extended Choice Parameter Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-27203

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:extended-choice-parameter <= 346.vd87693c5a no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.

References

External links from the advisory. They lead to third-party sites.