CVE-2022-34177: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

June 24, 2022 (updated July 5, 2022)

Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for file parameters for Pipeline input steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

References

github.com/advisories/GHSA-29q6-p2cg-4v23
nvd.nist.gov/vuln/detail/CVE-2022-34177
www.jenkins.io/security/advisory/2022-06-22/

Code Behaviors & Features

Detect and mitigate CVE-2022-34177 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →