CVE-2022-45388

Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system.

Score

CVSS 3.1 7.5 High

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2022-11-15

Last modified

2025-04-30

Weaknesses

CWE-22

Affected products

• Config Rotator (Jenkins)
• Jenkins Config Rotator Plugin (Jenkins Project)

References

• http://www.openwall.com/lists/oss-security/2022/11/15/4
• https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2842