CVE-2022-25173GHSA-4M7P-55JM-3VWV
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2656.vf7a, 2.94.1, 2.92.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Timeline
- CVE published
- Record last updated
Affected versions
- Jenkins project Jenkins Pipeline: Groovy Plugin
through 2648.va9433432b33c
- org.jenkins-ci.plugins.workflow:workflow-cpsMaven
From 2646.v6ed3b5b01ff1 · fixed in 2656.vf7a
- org.jenkins-ci.plugins.workflow:workflow-cpsMaven
From 2.93 · fixed in 2.94.1
- org.jenkins-ci.plugins.workflow:workflow-cpsMaven
fixed in 2.92.1