CVE-2022-34177: 
Java vulnerability analysis and mitigation

CVE-2022-34177 is a high-severity vulnerability affecting the Pipeline: Input Step Plugin in Jenkins versions 448.v37cea_9a_10a_70 and earlier. The vulnerability was disclosed on June 22, 2022, as part of Jenkins Security Advisory 2022-06-22 (Jenkins Advisory).

The vulnerability allows Pipeline authors to specify file parameters for Pipeline input steps, despite these being unsupported. When a file is uploaded, Jenkins archives it on the controller as part of build metadata, using the parameter name without proper sanitization as a relative path inside a build-related directory. The vulnerability has been assigned a severity rating of High (Jenkins Advisory).

This vulnerability enables attackers with Pipeline configuration capabilities to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content (Jenkins Advisory).

The vulnerability is exploitable by attackers who have permissions to configure Pipelines in Jenkins. The exploitation occurs through the manipulation of file parameters in Pipeline input steps (Jenkins Advisory).

The vulnerability has been fixed in Pipeline: Input Step Plugin version 449.v77f0e8b_845c4. The fix prohibits the use of file parameters for Pipeline input steps, and any attempts to use them will result in Pipeline execution failure (Jenkins Advisory).