Read the docs
TI-2022-22347 Aliases CVE-2022-45381GHSA-3g9q-cmgv-g4p6

Path traversal in Jenkins Pipeline Utility Steps Plugin

Priority MEDIUM 40CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01444 73rd percentileScored 2026-11-07
Fix Partial org.jenkins-ci.plugins:pipeline-utility-steps (Maven): 2.13.2Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Pipeline Utility Steps Pluginup to 2.13.1—No fix listedCNA
—org.jenkins-ci.plugins:pipeline-utility-steps (Maven)before 2.13.22.13.2Patch availableGHSA-3g9q-cmgv-g4p6
  • Jenkins Pipeline Utility Steps Plugin VendorJenkins Affected up to 2.13.1 Fixed in — No fix listed CNA
  • org.jenkins-ci.plugins:pipeline-utility-steps (Maven) Vendor— Affected before 2.13.2 Fixed in 2.13.2 Patch available GHSA-3g9q-cmgv-g4p6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:pipeline_utility_steps:*:*:*:*:*:jenkins:*:*before 2.13.2VulnerableJenkins
  • cpe:2.3:a:jenkins:pipeline_utility_steps:*:*:*:*:*:jenkins:*:* Versions before 2.13.2 Vulnerable ·Jenkins

Remediation

  • Fix · GHSA-3g9q-cmgv-g4p6 org.jenkins-ci.plugins:pipeline-utility-steps (Maven) Fixed in 2.13.2 Advisory →

Red Hat 2 advisories

  • RHSA-2023:0777 Released 2023-02-23 · Red Hat rating Critical
    OpenShift Container Platform 4.9.56 security update
    • Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins-4.9.1675668922-1.el8, jenkins-2.361.1.1675668150-1.el8
  • RHSA-2023:0560 Released 2023-02-08 · Red Hat rating Critical
    OpenShift Container Platform 4.10.51 security update
    • Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins-4.10.1675144701-1.el8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2023:0560
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2023:0777
Not affected: 2 products
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-45381
  2. 2026-10-03 Alias added: GHSA-3g9q-cmgv-g4p6

References

Advisory 2

Other 3

  • TI-2023-16169 Out-of-bounds write in Jenkins Pipeline Utility Steps Plugin CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences