by Kastro
Paper/Archive/CVE-2022-34181

CVE-2022-34181

Jenkins project Jenkins xUnit Plugin — Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't ex…

EPSS 1%CVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 71.4.714 × 2014.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist, and parsing files inside it as test results, allowing attackers able to control agent processes to create an arbitrary directory on the Jenkins controller or to obtain test results from existing files in an attacker-specified directory.

Affected

ProductAffectedFixed inSource
Jenkins xUnit Pluginunspecified – 3.0.8–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refjenkins.io/security/advisory/2022-06-22/#SECURITY-2549