Every CVE Search/ Get API key

CVE-2022-45381

Arbitrary file read vulnerability in Jenkins Pipeline Utility Steps Plugin

8.1 HighFix available

Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.44%Up 0.6 points since Nov 16, 2022
90%50%10%1%

What each source reports

NVD Score used 8.1

Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.

Record
CVE-2022-45381
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE List 8.1

Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.

Record
CVE-2022-45381
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2022-7209 8.1

Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.

Record
EUVD-2022-7209
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-3g9q-cmgv-g4p6 7.5

Arbitrary file read vulnerability in Jenkins Pipeline Utility Steps Plugin

Pipeline Utility Steps Plugin implements a readProperties Pipeline step that supports interpolation of variables using the Apache Commons Configuration library.

Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of this library that enable the file: prefix interpolator by default.

This allows attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.

Pipeline Utility Steps Plugin 2.13.2 restricts the set of prefix interpolators enabled by default to base64Decoder:, base64Encoder:, date:, urlDecoder:, and urlEncoder:.

Administrators can set the Java system property org.jenkinsci.plugins.pipeline.utility.steps.conf.ReadPropertiesStepExecution.CUSTOM_PREFIX_INTERPOLATOR_LOOKUPS to customize which prefix interpolators are enabled.

Record
GHSA-3g9q-cmgv-g4p6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-3g9q-cmgv-g4p6 7.5

Arbitrary file read vulnerability in Jenkins Pipeline Utility Steps Plugin

Pipeline Utility Steps Plugin implements a readProperties Pipeline step that supports interpolation of variables using the Apache Commons Configuration library.

Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of this library that enable the file: prefix interpolator by default.

This allows attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.

Pipeline Utility Steps Plugin 2.13.2 restricts the set of prefix interpolators enabled by default to base64Decoder:, base64Encoder:, date:, urlDecoder:, and urlEncoder:.

Administrators can set the Java system property org.jenkinsci.plugins.pipeline.utility.steps.conf.ReadPropertiesStepExecution.CUSTOM_PREFIX_INTERPOLATOR_LOOKUPS to customize which prefix interpolators are enabled.

Record
GHSA-3g9q-cmgv-g4p6
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVRHSA-2023:0560 9.9

Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update

Record
RHSA-2023:0560
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:0777 9.9

Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update

Record
RHSA-2023:0777
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.plugins:pipeline-utility-steps
Maven
 through 2.13.1
2.13.2
org.jenkins-ci.plugins:pipeline-utility-steps
Maven
 before 2.13.2, plus listed versions
1.01.11.1.11.1.21.1.3
Show 33 moreShow less
1.1.41.1.51.1.61.2.01.2.11.2.21.3.01.4.01.4.11.5.01.5.12.02.0.12.0.22.1.02.10.02.11.02.12.02.12.12.12.22.13.02.13.12.2.02.3.02.3.12.4.02.5.02.6.02.6.12.7.02.7.12.8.02.9.0
2.13.2
jenkins-2-plugins
Red Hat:openshift:4.10::el8
From an advisory covering 23 CVEs
 before 0:4.10.1675144701-1.el8
0:4.10.1675144701-1.el8
jenkins-2-plugins
Red Hat:openshift:4.9::el8
From an advisory covering 26 CVEs
 before 0:4.9.1675668922-1.el8
0:4.9.1675668922-1.el8
jenkins
Red Hat:openshift:4.9::el8
From an advisory covering 26 CVEs
 before 0:2.361.1.1675668150-1.el8
0:2.361.1.1675668150-1.el8

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-45381 is a high vulnerability (CVSS 8.1) in Jenkins Pipeline Utility Steps, published November 15, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in org.jenkins-ci.plugins:pipeline-utility-steps 2.13.2.

References

Show 117 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open