GHSA-298j-9q4w-6rm4

Source

https://github.com/advisories/GHSA-298j-9q4w-6rm4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-298j-9q4w-6rm4/GHSA-298j-9q4w-6rm4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-298j-9q4w-6rm4

Aliases

CVE-2022-34181

Published

2022-06-24T00:00:31Z

Modified

2023-11-08T04:09:42.740099Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Agent-to-controller security bypass in Jenkins xUnit Plugin

Details

xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn’t exist, and parsing files inside it as test results.

This allows attackers able to control agent processes to create an arbitrary directory on the Jenkins controller or to obtain test results from existing files in an attacker-specified directory.

xUnit Plugin 3.1.0 changes the message type from agent-to-controller to controller-to-agent, preventing execution on the controller.

Database specific

{
    "nvd_published_at": "2022-06-23T17:15:00Z",
    "github_reviewed_at": "2022-07-05T23:00:04Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-693"
    ]
}

References

Affected packages

Maven / org.jenkins-ci.plugins:xunit

Package

Name: org.jenkins-ci.plugins:xunit; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/xunit

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.0

Affected versions

1.*

1.22

1.23

1.24

1.25

1.26

1.26.1

1.27

1.28

1.29

1.30

1.31

1.32

1.33

1.34

1.35

1.36

1.37

1.38

1.39

1.40

1.41

1.42

1.43

1.44

1.45

1.46

1.47

1.48

1.49

1.50

1.51

1.52

1.53

1.54

1.55

1.56

1.57

1.58

1.59

1.60

1.61

1.62

1.63

1.64

1.65

1.66

1.67

1.68

1.69

1.70

1.71

1.72

1.73

1.74

1.75

1.76

1.77

1.78

1.79

1.80

1.81

1.82

1.83

1.84

1.88

1.89

1.90

1.91

1.92

1.93

1.94

1.95

1.96

1.97

1.98

1.99

1.100

1.101

1.102

1.103

1.104

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.1.0

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.4.0

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8