Vulnerability · Published Feb 15, 2022 · Assigned by jenkins

CVE-2022-25183

High 8.8

In plain English

A high-severity security flaw in Jenkins Pipeline: Shared Groovy Libraries Plugin from Jenkins project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High

Exploit odds (30 days)1.6%top 24.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library configured to use caching already exists.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	561.va_ce0de3c2d69	GHSA-pfwp-q984-w7wh

Affected products (as reported)

Vendor	Product	Versions
Jenkins project	Jenkins Pipeline: Shared Groovy Libraries Plugin	unspecified – through 552.vd9cc05b8a2e12.21 – before unspecified

References

https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2586 x_refsource_CONFIRM