CVE-2022-25177 — Link Following in Project Jenkins Pipeline Shared Groovy Libraries Plugin

CWE-59 — Link Following6 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 29.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Pipeline Shared Groovy Libraries PluginJenkins Pipeline
Timeline
PublishedFeb 15
Latest updateFeb 16

Description

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_pipeline_shared_groovy_libraries_pluginunspecified — 552.vd9cc05b8a2e1
▶NVDjenkins/pipeline552.vd9cc05b8a2e1

Patches

Patch: www.jenkins.io ↗Patch: www.jenkins.io ↗

🔴Vulnerability Details

3
OSV
Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin↗2022-02-16
▶
GHSA
Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin↗2022-02-16
▶
CVEList
CVE-2022-25177: Jenkins Pipeline: Shared Groovy Libraries Plugin 552↗2022-02-15
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2022-02-15↗2022-02-15
▶
Red Hat
workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names↗2022-02-15
▶
CVE-2022-25177 — Link Following | cvebase