GHSA-j5qq-6rpm-qjgh

Jenkins Deployer Framework Plugin does not restrict application path of applications when configuring a deployment

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-36889

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:deployer-framework	< 86.v7b_a_4a_55b_f3ec	86.v7b_a_4a_55b_f3ec

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-36889 advisory
https://github.com/jenkinsci/deployer-framework-plugin package
https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2764 web
http://www.openwall.com/lists/oss-security/2022/07/27/1 web