Rapid7 Vulnerability & Exploit Database

Jenkins Advisory 2022-06-22: CVE-2022-34181: Agent-to-controller security bypass in xUnit Plugin

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

Jenkins Advisory 2022-06-22: CVE-2022-34181: Agent-to-controller security bypass in xUnit Plugin

Severity
6
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:N)
Published
06/23/2022
Created
07/16/2022
Added
07/12/2022
Modified
07/15/2022

Description

Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn't exist, and parsing files inside it as test results, allowing attackers able to control agent processes to create an arbitrary directory on the Jenkins controller or to obtain test results from existing files in an attacker-specified directory.

Solution(s)

  • jenkins-lts-upgrade-2_332_4
  • jenkins-upgrade-2_356

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;