CVE-2022-28157: Path Traversal
Published Mar 29, 2022
·Updated
Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server.
Affected Software
2 affected components
maven/com.surenpi.jenkins:phoenix-autotest<=1.3
Jenkins Pipeline\<=1.3
Event History
Mar 29, 2022
CVE Published
via MITRE·12:31 PM
Data Sourced
via MITRE·12:31 PM
Description
Mar 30, 2022
Advisory Published
12:00 AM
Frequently Asked Questions
1
What is the severity of CVE-2022-28157?
CVE-2022-28157 is classified as a high severity vulnerability due to the potential for attackers to upload arbitrary files to an FTP server.
2
How do I fix CVE-2022-28157?
To fix CVE-2022-28157, upgrade to Phoenix AutoTest Plugin version 1.4 or later.
3
Who is affected by CVE-2022-28157?
Users of Jenkins with the Phoenix AutoTest Plugin versions 1.3 and earlier are affected by CVE-2022-28157.
4
What permissions are required to exploit CVE-2022-28157?
An attacker needs Item/Configure permissions to exploit CVE-2022-28157.
5
What kind of attack is possible with CVE-2022-28157?
CVE-2022-28157 allows attackers to upload arbitrary files from the Jenkins controller to an external FTP server.