Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2022-27201 Details

Description

Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2124 CVEVendor Advisory
http://www.openwall.com/lists/oss-security/2022/03/15/2 CVEMailing ListThird Party Advisory
https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2124 [email protected]Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/03/15/2 [email protected]Mailing ListThird Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
NVD-CWE-OtherWeakness Not in a Standard CWE Category[email protected]

Affected Products

ProductVersions
jenkins semantic versioning
<= 1.13

CPE

  • cpe:2.3:a:jenkins:semantic_versioning:*:*:*:*:*:jenkins:*:*

Remediation

  • No remediation found in references.
jenkins jenkins
<= 2.303.2
<= 2.318

CPE

  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*

Remediation

  • No remediation found in references.

Change History

9 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2022-27201
NVD Published Date:
Mar 15, 2022
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2022-27201 Details - Not Deferred