CVE-2022-25175
published 2022-02-15CVE-2022-25175: Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing…
high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | agent_server_parameter_plugin | — | — |
| jenkins | build_step_plugin | — | — |
| jenkins | checkmarx_plugin | — | — |
| jenkins | chef_sinatra_plugin | — | — |
| jenkins | conjur_secrets_plugin | — | — |
| jenkins | convertigo_mobile_platform_plugin | — | — |
| jenkins | custom_checkbox_parameter_plugin | — | — |
| jenkins | deprecated_groovy_libraries_plugin | — | — |
| jenkins | doktor_plugin | — | — |
| jenkins | fortify_plugin | — | — |
| jenkins | generic_webhook_trigger_plugin | — | — |
| jenkins | gitlab_authentication_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | hashicorp_vault_plugin | — | — |
| jenkins | multibranch_plugin | — | — |
| jenkins | pipeline | <= 706.vd43c65dec013 | — |
| jenkins | scp_publisher_plugin | — | — |
| jenkins | snow_commander_plugin | — | — |
| jenkins | support_core_plugin | — | — |
| jenkins | swamp_plugin | — | — |
| jenkins | team_views_plugin | — | — |
| jenkins_project | jenkins_pipeline_multibranch_plugin | unspecified – 706.vd43c65dec013 | — |