CVE-2022-34177: vulnerability in Jenkins Pipeline: Input Step Plugin
Published · Updated
Follow this CVE+ Monitor Jenkins Pipeline: Input Step Plugin+ Monitor org.jenkins-ci.plugins:pipeline-input-step
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.7%
Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.
Affected products
Jenkins project · Jenkins Pipeline: Input Step PluginRelated CVEs — Jenkins Pipeline: Input Step Plugin
In the same product, most dangerous first.