Vulnerability · Published Feb 15, 2022 · Assigned by jenkins

CVE-2022-25174

High 8.8

In plain English

A high-severity security flaw in Jenkins Pipeline: Shared Groovy Libraries Plugin from Jenkins project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High

Exploit odds (30 days)1.4%top 27.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	561.va	GHSA-g9fx-6j5c-grmw
Maven	org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	2.21.1	GHSA-g9fx-6j5c-grmw
Maven	org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	2.18.1	GHSA-g9fx-6j5c-grmw

Affected products (as reported)

Vendor	Product	Versions
Jenkins project	Jenkins Pipeline: Shared Groovy Libraries Plugin	unspecified – through 552.vd9cc05b8a2e1

References

https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2463 x_refsource_CONFIRM