CVE-2022-25177
published 2022-02-15CVE-2022-25177: Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library…
PriorityP341medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.74%
77.6th percentile
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | agent_server_parameter_plugin | — | — |
| jenkins | build_step_plugin | — | — |
| jenkins | checkmarx_plugin | — | — |
| jenkins | chef_sinatra_plugin | — | — |
| jenkins | conjur_secrets_plugin | — | — |
| jenkins | convertigo_mobile_platform_plugin | — | — |
| jenkins | custom_checkbox_parameter_plugin | — | — |
| jenkins | deprecated_groovy_libraries_plugin | — | — |
| jenkins | doktor_plugin | — | — |
| jenkins | fortify_plugin | — | — |
| jenkins | generic_webhook_trigger_plugin | — | — |
| jenkins | gitlab_authentication_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | hashicorp_vault_plugin | — | — |
| jenkins | multibranch_plugin | — | — |
| jenkins | pipeline | <= 552.vd9cc05b8a2e1 | — |
| jenkins | scp_publisher_plugin | — | — |
| jenkins | snow_commander_plugin | — | — |
| jenkins | support_core_plugin | — | — |
| jenkins | swamp_plugin | — | — |
| jenkins | team_views_plugin | — | — |
| jenkins_project | jenkins_pipeline_shared_groovy_libraries_plugin | unspecified – 552.vd9cc05b8a2e1 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin
osv·2022-02-16
CVE-2022-25177 [MEDIUM] Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin
Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.
GHSA
Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin
ghsa·2022-02-16
CVE-2022-25177 [MEDIUM] CWE-59 Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin
Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.
Jenkins
Jenkins Security Advisory 2022-02-15
vendor_jenkins·2022-02-15·CVSS 8.8
CVE-2022-25173 [HIGH] Jenkins Security Advisory 2022-02-15
Title: Jenkins Security Advisory 2022-02-15
Jenkins Security Advisory 2022-02-15
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Agent Server Parameter
Plugin
autonomiq
Plugin
Checkmarx
Plugin
Conjur Secrets
Plugin
Convertigo Mobile Platform
Plugin
Custom Checkbox Parameter
Plugin
dbCharts
Pl
Red Hat
workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names
vendor_redhat·2022-02-15·CVSS 6.5
CVE-2022-25177 [MEDIUM] CWE-59 workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names
workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.
A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step. This flaw allows attackers who can configure Pipelines to read arbitrary files on the Jenkins controller file system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-02-15
Published