CVE-2022-34179 Path Traversal vulnerability in Jenkins Embeddable Build Status Plugin

What is CVE-2022-34179?

CVE-2022-34179 is a high-severity path traversal vulnerability in Jenkins Embeddable Build Status Plugin, published on 22 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to specify paths to other SVG images on the Jenkins controller file system.

Weakness: CWE-22

Which versions are affected by CVE-2022-34179?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:embeddable-build-status. It affects 1 product.

Products include Jenkins Embeddable Build Status.

How do I fix CVE-2022-34179?

Upgrade org.jenkins-ci.plugins:embeddable-build-status to 2.0.4 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-34179 being exploited?

There is no known exploitation of CVE-2022-34179 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Embeddable Build Status Plugin

• CVE-2022-34180 Improper authorization in Jenkins Embeddable Build Status Plugin bypasses ViewStatus permission requirement High 7.5
• CVE-2022-34178 Reflected Cross site scripting in Jenkins Embeddable Build Status Plugin Medium 6.1
• CVE-2019-10346 Jenkins Embeddable Build Status Plugin contains Cross-site Scripting Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-93mx-2vf9-28c4.