CVE-2022-23113: 
Java vulnerability analysis and mitigation

The Jenkins Publish Over SSH Plugin version 1.22 and earlier contains a path traversal vulnerability (CVE-2022-23113) that was disclosed on January 12, 2022. The vulnerability affects the file name validation functionality and allows attackers with Item/Configure permission to discover the names of files on the Jenkins controller (Jenkins Advisory, NVD).

The vulnerability stems from improper validation of file names in the Publish Over SSH Plugin. Specifically, the plugin performs a basic validation check that only verifies whether a file name is present or not, without properly restricting path traversal attempts. This implementation weakness allows attackers to traverse directories on the Jenkins controller file system. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The primary impact of this vulnerability is the potential exposure of sensitive information. Attackers who successfully exploit this vulnerability can discover the names of files present on the Jenkins controller system, which could aid in further attacks or lead to the disclosure of sensitive information (Jenkins Advisory).

The vulnerability requires an attacker to have Item/Configure permission within the Jenkins environment to be exploited. This prerequisite somewhat limits the potential attack surface, as it requires a degree of privileged access to the system (Jenkins Advisory).

As of the advisory publication date, no official fix was available for this vulnerability in the Publish Over SSH Plugin. Organizations using affected versions (1.22 and earlier) should assess their risk and consider implementing additional access controls or monitoring mechanisms until a patch becomes available (Jenkins Advisory).

The vulnerability was discovered and reported by Kevin Guerroudj, Justin Philip, and Marc Heyries, demonstrating collaborative security research within the Jenkins community (Jenkins Advisory).