CVE-2022-34177
CVE-2022-34177
Vexday Risk Score
3Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS —EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
22 jun 2022Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.
Productos afectados
Jenkins project · Jenkins Pipeline: Input Step Plugin¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →