CVE-2022-25178
published 2022-02-15CVE-2022-25178: Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step…
PriorityP340medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.67%
76.6th percentile
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | agent_server_parameter_plugin | — | — |
| jenkins | build_step_plugin | — | — |
| jenkins | checkmarx_plugin | — | — |
| jenkins | chef_sinatra_plugin | — | — |
| jenkins | conjur_secrets_plugin | — | — |
| jenkins | convertigo_mobile_platform_plugin | — | — |
| jenkins | custom_checkbox_parameter_plugin | — | — |
| jenkins | deprecated_groovy_libraries_plugin | — | — |
| jenkins | doktor_plugin | — | — |
| jenkins | fortify_plugin | — | — |
| jenkins | generic_webhook_trigger_plugin | — | — |
| jenkins | gitlab_authentication_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | hashicorp_vault_plugin | — | — |
| jenkins | multibranch_plugin | — | — |
| jenkins | pipeline | <= 552.vd9cc05b8a2e1 | — |
| jenkins | scp_publisher_plugin | — | — |
| jenkins | snow_commander_plugin | — | — |
| jenkins | support_core_plugin | — | — |
| jenkins | swamp_plugin | — | — |
| jenkins | team_views_plugin | — | — |
| jenkins_project | jenkins_pipeline_shared_groovy_libraries_plugin | unspecified – 552.vd9cc05b8a2e1 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin
osv·2022-02-16
CVE-2022-25178 [MEDIUM] Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin
Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin
Jenkins Pipeline: Shared Groovy Libraries Plugin does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
GHSA
Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin
ghsa·2022-02-16
CVE-2022-25178 [MEDIUM] CWE-22 Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin
Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin
Jenkins Pipeline: Shared Groovy Libraries Plugin does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
Red Hat
workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names
vendor_redhat·2022-02-15·CVSS 6.5
CVE-2022-25178 [MEDIUM] CWE-59 workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names
workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries does not restrict the names of resources passed to the libraryResource step. This flaw allows attackers who can configure Pipelines to read arbitrary files on the Jenkins controller file system.
Jenkins
Jenkins Security Advisory 2022-02-15
vendor_jenkins·2022-02-15·CVSS 8.8
CVE-2022-25173 [HIGH] Jenkins Security Advisory 2022-02-15
Title: Jenkins Security Advisory 2022-02-15
Jenkins Security Advisory 2022-02-15
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Agent Server Parameter
Plugin
autonomiq
Plugin
Checkmarx
Plugin
Conjur Secrets
Plugin
Convertigo Mobile Platform
Plugin
Custom Checkbox Parameter
Plugin
dbCharts
Pl
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-02-15
Published