CVE-2022-25188 in Fortify Plugin

Sumário

de MITRE • 15/02/2022

Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Reservar: 15/02/2022
• Divulgação: 15/02/2022
• Moderação: aceite
• Entrada: VDB-193144
• CPE: pronto
• CWE: CWE-22 (confirmado)
• CVSS: 5.5 (VulDB)
• EPSS: 0.01219
• KEV: não
• Atividades: muito baixo
• Sector: Telecommunication

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2022-25188
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-25188
• CVE Details: https://www.cvedetails.com/cve/CVE-2022-25188/