CVE-2022-28148

published 2022-03-29

CVE-2022-28148: The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on Windows, resulting in…

Priority P3 40 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Item/Read permission to obtain the contents of arbitrary files on Windows controllers.

Affected

16 ranges

Vendor	Product	Version range	Fixed in
jenkins	bitbucket_server_integration_plugin	—	—
jenkins	complexity_scatter_plot_plugin	—	—
jenkins	continuous_integration_with_toad_edge	<= 2.3	—
jenkins	continuous_integration_with_toad_edge_plugin	—	—
jenkins	flaky_test_handler_plugin	—	—
jenkins	jenkins_core	—	—
jenkins	jiratestresultreporter_plugin	—	—
jenkins	job_and_node_ownership_plugin	—	—
jenkins	phoenix_autotest_plugin	—	—
jenkins	proxmox_plugin	—	—
jenkins	rocketchat_notifier_plugin	—	—
jenkins	sitemonitor_plugin	—	—
jenkins	some_reports_generated_by_this_plugin	—	—
jenkins	tests_selector_plugin	—	—
jenkins	windows_in_continuous_integration_with_toad_edge_plugin	—	—
jenkins_project	jenkins_continuous_integration_with_toad_edge_plugin	unspecified – 2.3	—

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22