CVE-2022-34179: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

June 24, 2022 (updated August 16, 2022)

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to specify paths to other SVG images on the Jenkins controller file system.

References

github.com/advisories/GHSA-93mx-2vf9-28c4
nvd.nist.gov/vuln/detail/CVE-2022-34179
www.jenkins.io/security/advisory/2022-06-22/

Code Behaviors & Features

Detect and mitigate CVE-2022-34179 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →