CVE-2022-27203: 
Java vulnerability analysis and mitigation

Jenkins Extended Choice Parameter Plugin version 346.vd87693c5a_86c and earlier contains a security vulnerability identified as CVE-2022-27203. The vulnerability was discovered and reported by Oleg Nenashev from CloudBees, Inc. and was publicly disclosed on March 15, 2022. This vulnerability affects the Extended Choice Parameter Plugin for Jenkins, which is a widely used automation server (Jenkins Advisory).

The vulnerability has been classified as Medium severity with a CVSS v3.1 Base Score of 6.5 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller (NVD).

The vulnerability enables unauthorized access to potentially sensitive information stored in JSON and Java properties files on the Jenkins controller. This could lead to the exposure of confidential configuration data, credentials, or other sensitive information stored in these files (Jenkins Advisory).

As of the advisory publication date, there was no fix available for this vulnerability in the Extended Choice Parameter Plugin. Users should carefully consider the permissions granted to users with Item/Configure access and monitor for potential unauthorized access to sensitive files (Jenkins Advisory).