Every CVE Search/ Get API key

CVE-2022-34177

Arbitrary file write vulnerability in Jenkins Pipeline: Input Step Plugin

7.5 HighFix available

Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for file parameters for Pipeline input steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.70%Up 0.8 points since Jun 23, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for file parameters for Pipeline input steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

Record
CVE-2022-34177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE List No score

Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for file parameters for Pipeline input steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

Record
CVE-2022-34177
Updated
2026-11-02
EUVDEUVD-2022-5891 No score

Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for file parameters for Pipeline input steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

Record
EUVD-2022-5891
Updated
2026-11-03
GitHub AdvisoriesGHSA-29q6-p2cg-4v23 8.8

Arbitrary file write vulnerability in Jenkins Pipeline: Input Step Plugin

Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier allows Pipeline authors to specify file parameters for Pipeline input steps even though they are unsupported. Although the uploaded file is not copied to the workspace, Jenkins archives the file on the controller as part of build metadata using the parameter name without sanitization as a relative path inside a build-related directory.

This allows attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

Pipeline: Input Step Plugin 449.v77f0e8b_845c4 prohibits use of file parameters for Pipeline input steps. Attempts to use them will fail Pipeline execution.

Record
GHSA-29q6-p2cg-4v23
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
OSV 7.5

Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for file parameters for Pipeline input steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a build-related directory, allowing attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

Record
CVE-2022-34177
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGHSA-29q6-p2cg-4v23 8.8

Arbitrary file write vulnerability in Jenkins Pipeline: Input Step Plugin

Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier allows Pipeline authors to specify file parameters for Pipeline input steps even though they are unsupported. Although the uploaded file is not copied to the workspace, Jenkins archives the file on the controller as part of build metadata using the parameter name without sanitization as a relative path inside a build-related directory.

This allows attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

Pipeline: Input Step Plugin 449.v77f0e8b_845c4 prohibits use of file parameters for Pipeline input steps. Attempts to use them will fail Pipeline execution.

Record
GHSA-29q6-p2cg-4v23
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
OSVRHSA-2022:6531 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.10.33 packages and security update

Record
RHSA-2022:6531
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2022:9110 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.9.54 packages and security update

Record
RHSA-2022:9110
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2023:0017 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.8.56 packages and security update

Record
RHSA-2023:0017
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.plugins:pipeline-input-step
Maven
 before 449.v77f0e8b
449.v77f0e8b
org.jenkins-ci.plugins:pipeline-input-step
Maven
 before 449.v77f0e8b, plus listed versions
2.02.12.102.112.12
Show 15 moreShow less
2.12.12.12.22.22.32.42.52.62.72.82.9427.va6441fa17010446.vf27b_0b_83500e447.449.v193fd29f6021447.v95e5a_6e3502a_448.v37cea_9a_10a_70
449.v77f0e8b
jenkins-2-plugins
Red Hat:openshift:4.10::el8
From an advisory covering 2 CVEs
 before 0:4.10.1663147786-1.el8
0:4.10.1663147786-1.el8
jenkins-2-plugins
Red Hat:openshift:4.9::el8
 before 0:4.9.1669894222-1.el8
0:4.9.1669894222-1.el8
jenkins
Red Hat:openshift:4.8::el8
From an advisory covering 16 CVEs
 before 0:2.361.1.1672840472-1.el8
0:2.361.1.1672840472-1.el8
jenkins-2-plugins
Red Hat:openshift:4.8::el8
From an advisory covering 16 CVEs
 before 0:4.8.1672842762-1.el8
0:4.8.1672842762-1.el8

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-34177 is a high vulnerability (CVSS 7.5) in Jenkins Project Pipeline: Input Step Plugin, published June 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. Fixed in org.jenkins-ci.plugins:pipeline-input-step 449.v77f0e8b.

References

Show 74 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open