CVE-2022-41235 - Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system

Back Back to CVE browser

MEDIUM

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system

Published Sep 21, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.69%

Description

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

Affected products

Vendor Jenkins project Product Jenkins WildFly Deployer Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=1.0.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins WildFly Deployer Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=1.0.2

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-22

Path Traversal

CWE-284

CWE-693

References (3)

https://github.com/advisories/GHSA-f7fq-wp2x-jc25
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41235
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2645
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-f7fq-wp2x-jc25		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41235
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2645		x_refsource_CONFIRMVendor Advisory