Jenkins WildFly Deployer Plugin vulnerable to path traversal

MITTEL 5.3CVE-2022-41235 · GHSA-f7fq-wp2x-jc25 · Published 21/09/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-41235 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in org.jenkins-ci.plugins:wildfly-deployer, wildfly deployer (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.69%, höher als bei 53.1% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:wildfly-deployer Maven	`≤ 1.0.2`	No fix yet
wildfly deployer jenkins	`≤ 1.0.2`	No fix yet

Description

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

NVD description

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

References

nvd.nist.gov/vuln/detail/CVE-2022-41235 · ADVISORY
jenkinsci/wildfly-deployer-plugin · PACKAGE
jenkins.io/security/advisory/2022-09-21 · WEB

Weitere Schwachstellen in org.jenkins-ci.plugins:wildfly-deployer

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Kurz gesagt

CVE-2022-41235 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in org.jenkins-ci.plugins:wildfly-deployer, wildfly deployer (jenkins).

Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.69%, höher als bei 53.1% aller Schwachstellen.

Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package

Affected versions

Patched versions

org.jenkins-ci.plugins:wildfly-deployer

Maven

≤ 1.0.2

No fix yet

wildfly deployer

jenkins

≤ 1.0.2

No fix yet

Description

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

NVD description

Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.