Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to specify paths to other SVG images on the Jenkins controller file system.
References
| Link | Resource |
|---|---|
| https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2792 | Vendor Advisory |
Configurations
History
03 Nov 2023, 18:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 |
25 Oct 2023, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
29 Jun 2022, 15:34
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:jenkins:embeddable_build_status:*:*:*:*:*:jenkins:*:* | |
| References | (CONFIRM) https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2792 - Vendor Advisory | |
| First Time |
Jenkins
Jenkins embeddable Build Status |
|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
23 Jun 2022, 17:19
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-06-23 17:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-34179
Mitre link : CVE-2022-34179
CVE.ORG link : CVE-2022-34179
JSON object : View
Products Affected
jenkins
- embeddable_build_status
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')