CVE-2022-23107

    Dashboard / Vulnerabilities / CVE-2022-23107

    CVE-2022-23107

    Published: 12 Jan 2022Last Modified: 9 Jul 2026

    Summary:

    Details: Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system.

    References: http://www.openwall.com/lists/oss-security/2022/01/12/6, https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2090

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4d3dbb23632860b19a626b3a25820ae746c958b3
    Fixed -669ed1017268386259277c2e7683f70e4a4ef6b2

    Affected versions

    9.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-23107 | CVE-DB