CVE-2022-27201

2022-03-1517:15:10

Google

osv.dev

0.001 Low

EPSS

Percentile

29.0%

JSON

Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

CPENameOperatorVersion
semantic-versioning-plugineqsemantic-versioning-plugin-1.6
semantic-versioning-plugineqsemantic-versioning-plugin-1.8
semantic-versioning-plugineqsemantic-versioning-plugin-1.13
semantic-versioning-plugineqsemantic-versioning-plugin-1.7
semantic-versioning-plugineqsemantic-versioning-plugin-1.10
semantic-versioning-plugineqsemantic-versioning-plugin-1.5
semantic-versioning-plugineqsemantic-versioning-plugin-1.12
semantic-versioning-plugineqsemantic-versioning-plugin-1.4
semantic-versioning-plugineqsemantic-versioning-plugin-1.11
semantic-versioning-plugineqsemantic-versioning-plugin-1.9

Name	Operator	Version
semantic-versioning-plugin	eq	semantic-versioning-plugin-1.6
semantic-versioning-plugin	eq	semantic-versioning-plugin-1.8
semantic-versioning-plugin	eq	semantic-versioning-plugin-1.13
semantic-versioning-plugin	eq	semantic-versioning-plugin-1.7
semantic-versioning-plugin	eq	semantic-versioning-plugin-1.10
semantic-versioning-plugin	eq	semantic-versioning-plugin-1.5
semantic-versioning-plugin	eq	semantic-versioning-plugin-1.12
semantic-versioning-plugin	eq	semantic-versioning-plugin-1.4
semantic-versioning-plugin	eq	semantic-versioning-plugin-1.11
semantic-versioning-plugin	eq	semantic-versioning-plugin-1.9