Severity
High
Analysis Summary
CVE-2022-45381
Jenkins Pipeline Utility Steps Plugin could allow a remote attacker to obtain sensitive information, caused by not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library. By sending a specially-crafted request, an attacker could exploit this vulnerability to read arbitrary files from the Jenkins controller file system., and use this information to launch further attacks against the affected system.
Impact
- Information Disclosure
Indicators Of Compromise
CVE
- CVE-2022-45381
Affected Vendors
Jenkins
Affected Products
Jenkins Pipeline Utility Steps Plugin 2.13.1
Remediation
Refer to Jenkins Security Advisory for patch, upgrade or suggested workaround information.