GHSA-f7fq-wp2x-jc25

Jenkins WildFly Deployer Plugin vulnerable to path traversal

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-41235

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:wildfly-deployer	<= 1.0.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system. This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#upgrading-to-jenkins-lts-2-303-3).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-41235 advisory
https://github.com/jenkinsci/wildfly-deployer-plugin package
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2645 web