CVE-2022-28156: 
Java vulnerability analysis and mitigation

CVE-2022-28156 is a path traversal vulnerability affecting the Pipeline: Phoenix AutoTest Plugin versions 1.3 and earlier in Jenkins. The vulnerability was disclosed on March 29, 2022, and is identified as SECURITY-2683. The affected component is the pipeline step 'copy' functionality within the phoenix-autotest plugin (Jenkins Advisory).

The vulnerability exists in the Pipeline: Phoenix AutoTest Plugin's implementation of a Pipeline step (copy) that copies files from the running build's directory on the Jenkins controller to an agent. The critical issue is that the plugin does not properly sanitize the path specified in this operation. The severity is rated as Medium according to CVSS scoring (Jenkins Advisory).

This vulnerability allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace. This could potentially lead to unauthorized access to sensitive files and information disclosure (Jenkins Advisory).

As of the advisory's publication date, there was no fix available for this vulnerability. Users of the Pipeline: Phoenix AutoTest Plugin version 1.3 and earlier should assess their risk and consider implementing additional access controls to limit Item/Configure permissions (Jenkins Advisory).