High severityNVD Advisory· Published Jun 22, 2022· Updated Aug 3, 2024

CVE-2022-34177

Description

Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for file parameters for Pipeline input steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:pipeline-input-stepMaven	< 449.v77f0e8b	449.v77f0e8b

Affected products

ghsa-coords
pkg:maven/org.jenkins-ci.plugins/pipeline-input-step
Range: < 449.v77f0e8b
Jenkins Project/Jenkins Jira Pipeline Steps Plugincpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-29q6-p2cg-4v23ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-34177ghsaADVISORY
github.com/jenkinsci/pipeline-input-step-plugin/commit/77f0e8b845c4ad429f6c717eab21cf4e7a69168eghsaWEB
www.jenkins.io/security/advisory/2022-06-22/ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000