CVE-2022-45381: 
Java vulnerability analysis and mitigation

CVE-2022-45381 is a high-severity vulnerability affecting the Pipeline Utility Steps Plugin in Jenkins. The vulnerability was discovered in November 2022 and affects versions up to and including 2.13.1. The vulnerability exists in the readProperties Pipeline step that supports interpolation of variables using the Apache Commons Configuration library (Jenkins Advisory).

The vulnerability stems from the Pipeline Utility Steps Plugin not restricting the set of enabled prefix interpolators and bundling versions of the Apache Commons Configuration library that enable the file: prefix interpolator by default. The vulnerability has been assigned a severity rating of High (CVSS) (Jenkins Advisory).

This vulnerability allows attackers with the ability to configure Pipelines to read arbitrary files from the Jenkins controller file system, potentially exposing sensitive information (Jenkins Advisory).

The vulnerability was fixed in Pipeline Utility Steps Plugin version 2.13.2, which restricts the set of prefix interpolators enabled by default to base64Decoder:, base64Encoder:, date:, urlDecoder:, and urlEncoder:. Administrators can customize which prefix interpolators are enabled by setting the Java system property org.jenkinsci.plugins.pipeline.utility.steps.conf.ReadPropertiesStepExecution.CUSTOM_PREFIX_INTERPOLATOR_LOOKUPS (Jenkins Advisory).