CVE-2022-36890

🗓️ 27 Jul 2022 14:22:40Reported by jenkinsType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 138 Views🌐 WEB

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system

Reporter	Title	Published	Views	Family All 19
attackerkb	CVE-2022-36890	27 Jul 202215:15	–	attackerkb
AlpineLinux	CVE-2022-36890	27 Jul 202214:22	–	alpinelinux
BDU FSTEC	Jenkins Deployer Framework Plugin Path Traversal	10 Aug 202200:00	–	bdu_fstec
Tenable Nessus	Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.15 / 2.346.2.3 Multiple Vulnerabilities (CloudBees Security Advisory 2022-07-27)	7 Oct 202200:00	–	nessus
CNNVD	Jenkins Plugin Deployer Framework Path Traversal Vulnerability	27 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-36890	27 Jul 202214:22	–	cvelist
EUVD	EUVD-2022-6349	3 Oct 202520:07	–	euvd
Github Security Blog	Jenkins Deployer Framework Plugin vulnerable to Path Traversal	28 Jul 202200:00	–	github
Mend	CVE-2022-36890	27 Jul 202214:22	–	mend
NVD	CVE-2022-36890	27 Jul 202215:15	–	nvd

NVD

Vulners

Node

jenkins deployer_frameworkRange≤85.v1d1888e8c021jenkins

[
  {
    "product": "Jenkins Deployer Framework Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "85.v1d1888e8c021",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "1.3.1"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2022/07/27/1
jenkins	www.jenkins.io/security/advisory/2022-07-27/

Parameter	Position	Path	Description	CWE
file_path	request body	/job/any-job-name/deployer-framework/validate	The Jenkins Deployer Framework Plugin fails to restrict the file path provided in form validation methods, allowing an attacker to check for the existence of arbitrary files on the controller's filesystem.	CWE-22

17 Jun 2026 04:54Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.14.3

EPSS0.0119

CWE-22