CVE-2022-25188 in Fortify Plugin

Resumen

por MITRE • 2022-02-15

Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Reservar: 2022-02-15
• Divulgación: 2022-02-15
• Moderación: aceptado
• Artículo: VDB-193144
• CPE: listo
• CWE: CWE-22 (confirmado)
• CVSS: 5.5 (VulDB)
• EPSS: 0.01219
• KEV: no
• Actividades: muy bajo
• Sector: Telecommunication

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2022-25188
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-25188
• CVE Details: https://www.cvedetails.com/cve/CVE-2022-25188/