Vulnerability · Published Apr 12, 2022 · Assigned by jenkins

CVE-2022-29047

Medium 5.3

In plain English

A medium-severity security flaw in Jenkins Pipeline: Shared Groovy Libraries Plugin from Jenkins project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)1.2%top 32.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	2.21.3	GHSA-hh6f-6fp5-gfpv
Maven	org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	566.vd0a	GHSA-hh6f-6fp5-gfpv

Affected products (as reported)

Vendor	Product	Versions
Jenkins project	Jenkins Pipeline: Shared Groovy Libraries Plugin	unspecified – through 564.ve62a_4eb_b_e039

References

https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951 x_refsource_CONFIRM