{"id":"CVE-2022-45388","aliases":["EUVD-2022-7308","GHSA-9pqq-h9qv-28fp"],"status":"published","title":"Jenkins Config Rotator Plugin vulnerable to path traversal","description":"Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01197,"percentile":0.68352,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2022-11-15T00:00:00Z","modified":"2026-06-17T05:09:57Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.main:config-rotator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.main:config-rotator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.1"}]}]}],"products":[{"vendor":"jenkins","product":"config_rotator"},{"vendor":"jenkins project","product":"jenkins config rotator plugin"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2842","tags":["x_transferred","Vendor Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/11/15/4","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45388","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9pqq-h9qv-28fp"},{"url":"https://github.com/jenkinsci/config-rotator-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-45388","description":"Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2025-04-30T17:37:29.775Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:31.519788Z"}],"euvd":[{"id":"EUVD-2022-7308","description":"Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system.","status":"published","published":"2022-11-15T00:00:00Z","modified":"2025-04-30T17:37:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:51:58.556756Z"}],"ghsa":[{"id":"GHSA-9pqq-h9qv-28fp","title":"Jenkins Config Rotator Plugin vulnerable to path traversal","description":"Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system. Currently there is no known workaround and no fix available.","status":"published","published":"2022-11-16T12:00:23Z","modified":"2023-11-05T05:04:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:13.301199Z"}],"nvd":[{"id":"CVE-2022-45388","description":"Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system.","status":"published","published":"2022-11-15T20:15:12.15Z","modified":"2026-06-17T05:09:57.14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:32.395456Z"}],"osv":[{"id":"GHSA-9pqq-h9qv-28fp","title":"Jenkins Config Rotator Plugin vulnerable to path traversal","description":"Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system. Currently there is no known workaround and no fix available.","status":"published","published":"2022-11-16T12:00:23Z","modified":"2023-11-08T04:10:52.045337Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:43.875515Z"}]}}