CVE-2022-45388: Jenkins Config Rotator Plugin vulnerable to path traversal

The vulnerability stems from an unauthenticated HTTP endpoint that accepts a file name parameter without restricting path traversal characters. The plugin's failure to validate/sanitize this parameter allows attackers to escape the intended directory and read .xml files. While the exact function name isn't provided in advisories, Jenkins plugins typically implement HTTP endpoints via servlet classes with methods like doGet/doPost. The confidence is high because the advisory explicitly states the lack of parameter validation in an HTTP endpoint as the root cause.