CVE-2022-45388

Description

Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with .xml extension on the Jenkins controller file system.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.239

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2022-45388 are affected in Jenkins - config-rotator 2.0.1	Windows
Vulnerabilities CVE-2022-45388 are affected in Jenkins - config-rotator for Linux 2.0.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234