CVE-2022-34177: 
Java vulnerability analysis and mitigation

CVE-2022-34177 is a high-severity vulnerability affecting the Pipeline: Input Step Plugin in Jenkins versions 448.v37cea9a10a_70 and earlier. The vulnerability was disclosed on June 22, 2022, as part of Jenkins Security Advisory 2022-06-22 (Jenkins Advisory).

The vulnerability allows Pipeline authors to specify file parameters for Pipeline input steps, despite these being unsupported. When a file is uploaded, Jenkins archives it on the controller as part of build metadata, using the parameter name without proper sanitization as a relative path inside a build-related directory. The vulnerability has been assigned a severity rating of High (Jenkins Advisory).

This vulnerability enables attackers with Pipeline configuration capabilities to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content (Jenkins Advisory).

The vulnerability has been fixed in Pipeline: Input Step Plugin version 449.v77f0e8b_845c4. The fix prohibits the use of file parameters for Pipeline input steps, and any attempts to use them will result in Pipeline execution failure (Jenkins Advisory).