CVE-2022-36889
Jenkins Deployer Framework Plugin does not restrict application path of applications when configuring a deployment
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
- Record
CVE-2022-36889- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
- Record
CVE-2022-36889- Updated
- 2026-11-02
EUVDEUVD-2022-6360 No score
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
- Record
EUVD-2022-6360- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j5qq-6rpm-qjgh
Jenkins Deployer Framework Plugin does not restrict application path of applications when configuring a deployment
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
- Record
GHSA-j5qq-6rpm-qjgh- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-j5qq-6rpm-qjgh
Jenkins Deployer Framework Plugin does not restrict application path of applications when configuring a deployment
Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
- Record
GHSA-j5qq-6rpm-qjgh- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:deployer-frameworkMaven |
through 85.v1d1888e8c021 | 86.v7b_a_4a_55b_f3ec |
org.jenkins-ci.plugins:deployer-frameworkMaven |
before 86.v7b_a_4a_55b_f3ec, plus listed versions 1.01.11.21.31.3.1 Show 4 moreShow less64.v3400230d12da_69.v0fcb_86e90e0875.vcc73e3a_89e6485.v1d1888e8c021 |
86.v7b_a_4a_55b_f3ec |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-36889 is a high vulnerability (CVSS 8.8) in Jenkins Deployer Framework, published July 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 77th percentile. Fixed in org.jenkins-ci.plugins:deployer-framework 86.v7b_a_4a_55b_f3ec.