CVE-2022-34181: Critical severity jenkins vulnerability
Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist, and parsing files inside it as test results, allowing attackers able to control agent processes to create an arbitrary directory on the Jenkins controller or to obtain test results from existing files in an attacker-specified directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-34181?
CVE-2022-34181 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2022-34181?
To fix CVE-2022-34181, update the Jenkins xUnit Plugin to version 3.0.9 or later.
What is the potential impact of CVE-2022-34181?
The potential impact of CVE-2022-34181 includes unauthorized directory creation on the Jenkins controller, leading to possible malicious activity.
Who is affected by CVE-2022-34181?
CVE-2022-34181 affects users of Jenkins xUnit Plugin versions 3.0.8 and earlier.
What action should I take if I cannot upgrade to fix CVE-2022-34181?
If upgrading is not possible, consider implementing strict access controls to limit agent process capabilities as a temporary mitigation for CVE-2022-34181.