Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system. Currently there is no known workaround and no fix available.

Affected Packages

Maven org.jenkins-ci.main:config-rotator

Affected versions: 0 (last affected: 2.0.1)

Related CVEs

CVE-2022-45388

Key Information

GHSA ID

GHSA-9pqq-h9qv-28fp

Published

November 16, 2022 12:00 PM

Last Modified

December 15, 2022 9:06 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.main:config-rotator

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 27, 2025 6:31 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.