CVE-2022-45388: Jenkins Config Rotator

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system.

Affected products

• Jenkins Config Rotator: up to and including 2.0.1

Published 2022-11-15. Last modified 2026-06-17.