TI-2022-07282 Aliases CVE-2022-23113 GHSA-j8rg-4hjm-8r95

Path traversal in Jenkins Publish Over SSH Plugin

LOW 23CWE-22Published 2022-01-12 · Updated 2024-10-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting in a path traversal vulnerability allowing attackers with Item/Configure permission to discover the name of the Jenkins controller files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01554 75th percentileScored 2026-11-07

Fix Fixed org.jenkins-ci.plugins:publish-over-ssh (Maven): 1.23

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins Publish Over SSH Plugin	up to 1.22	—	No fix listed	CNA
—	org.jenkins-ci.plugins:publish-over-ssh (Maven)	before 1.23	1.23	Patch available	GHSA-j8rg-4hjm-8r95

Jenkins Publish Over SSH Plugin VendorJenkins Affected up to 1.22 Fixed in — No fix listed CNA
org.jenkins-ci.plugins:publish-over-ssh (Maven) Vendor— Affected before 1.23 Fixed in 1.23 Patch available GHSA-j8rg-4hjm-8r95

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:publish_over_ssh::::::jenkins::*	up to 1.22	Vulnerable	Jenkins

cpe:2.3:a:jenkins:publish_over_ssh:*:*:*:*:*:jenkins:*:* Versions up to 1.22 Vulnerable ·Jenkins

Remediation

Fix · GHSA-j8rg-4hjm-8r95 org.jenkins-ci.plugins:publish-over-ssh (Maven) Fixed in 1.23 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-01-12
Jenkins Publish Over SSH Plugin unspecified
5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2022-07280 Cross-site request forgery in Jenkins Publish Over SSH PluginPriority MEDIUM 42
- TI-2022-07281 Missing authorization in Jenkins Publish Over SSH PluginPriority LOW 31
- TI-2022-07279 Cross-site scripting in Jenkins Publish Over SSH PluginPriority LOW 24
Show all 5 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-23113
2026-10-03 Alias added: GHSA-j8rg-4hjm-8r95

References

Advisory 3

Other 3

TI-2022-07280 Cross-site request forgery in Jenkins Publish Over SSH Plugin CVSS 3.1MEDIUM 4.3
TI-2022-07281 Missing authorization in Jenkins Publish Over SSH Plugin CVSS 3.1MEDIUM 6.5
TI-2022-07279 Cross-site scripting in Jenkins Publish Over SSH Plugin CVSS 3.1MEDIUM 4.8
TI-2022-07283 Insufficiently protected credentials in Jenkins Publish Over SSH Plugin CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences