CVE-2022-25174GHSA-G9FX-6J5C-GRMW
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipe
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 561.va, 2.21.1, 2.18.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Timeline
- CVE published
- Record last updated
Affected versions
- Jenkins project Jenkins Pipeline: Shared Groovy Libraries Plugin
through 552.vd9cc05b8a2e1
- org.jenkins-ci.plugins.workflow:workflow-cps-global-libMaven
From 544.vff04fa68714d · fixed in 561.va
- org.jenkins-ci.plugins.workflow:workflow-cps-global-libMaven
From 2.19 · fixed in 2.21.1
- org.jenkins-ci.plugins.workflow:workflow-cps-global-libMaven
fixed in 2.18.1