CVE-2022-25188 Path traversal vulnerability in Jenkins Fortify Plugin

What is CVE-2022-25188?

CVE-2022-25188 is a medium-severity path traversal vulnerability in Jenkins Fortify Plugin, published on 15 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker.

Weakness: CWE-22

Which versions are affected by CVE-2022-25188?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:fortify. It affects 1 product.

Products include Jenkins Fortify.

How do I fix CVE-2022-25188?

Upgrade org.jenkins-ci.plugins:fortify to 20.2.35 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-25188 being exploited?

There is no known exploitation of CVE-2022-25188 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Fortify Plugin

• CVE-2023-4303 HTML injection vulnerability in Fortify Plugin Medium 4.3
• CVE-2020-2107 Fortify Plugin stored credentials in plain text Medium 4.3
• CVE-2023-4301 CSRF vulnerability in Fortify Plugin allow capturing credentials Medium 4.2
• CVE-2023-4302 Missing permission checks in Fortify Plugin allow capturing credentials Medium 4.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-23h5-8ph6-7rfc.