CVE-2022-36889 Jenkins Deployer Framework Plugin does not restrict application path of applications when configuring a deployment

What is CVE-2022-36889?

CVE-2022-36889 is a high-severity path traversal vulnerability in Jenkins Deployer Framework Plugin, published on 27 Jul 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.

Weakness: CWE-22

Which versions are affected by CVE-2022-36889?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:deployer-framework. It affects 1 product.

Products include Jenkins Deployer Framework.

How do I fix CVE-2022-36889?

Upgrade org.jenkins-ci.plugins:deployer-framework to 86.v7b_a_4a_55b_f3ec or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-36889 being exploited?

There is no known exploitation of CVE-2022-36889 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Deployer Framework Plugin

• CVE-2020-2227 Stored XSS vulnerability in Jenkins Deployer Framework Plugin Medium 5.4
• CVE-2022-36890 Jenkins Deployer Framework Plugin vulnerable to Path Traversal Medium 4.3
• CVE-2022-36891 Jenkins Deployer Framework Plugin allows attackers with Item/Read permission to read deployment logs Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j5qq-6rpm-qjgh.