CVE-2022-43414

2022-10-1916:15:10

Google

osv.dev

jenkins

nunit plugin

cve-2022-43414

test results

agent-to-controller

directory parsing

security vulnerability

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

33.7%

JSON

Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test results, allowing attackers able to control agent processes to obtain test results from files in an attacker-specified directory on the Jenkins controller.

CPENameOperatorVersion
nunit-plugineqnunit-0.13
nunit-plugineqnunit-0.16
nunit-plugineqnunit-0.17
nunit-plugineqnunit-0.21
nunit-plugineqnunit-0.23
nunit-plugineqnunit-0.26
nunit-plugineqnunit-0.27
nunit-plugineqnunit-0.22
nunit-plugineqnunit-0.18
nunit-plugineqnunit-0.19

Name	Operator	Version
nunit-plugin	eq	nunit-0.13
nunit-plugin	eq	nunit-0.16
nunit-plugin	eq	nunit-0.17
nunit-plugin	eq	nunit-0.21
nunit-plugin	eq	nunit-0.23
nunit-plugin	eq	nunit-0.26
nunit-plugin	eq	nunit-0.27
nunit-plugin	eq	nunit-0.22
nunit-plugin	eq	nunit-0.18
nunit-plugin	eq	nunit-0.19