CVE-2022-25178 — Path Traversal in Project Jenkins Pipeline Shared Groovy Libraries Plugin

CWE-22 — Path TraversalCWE-59 — Link Following6 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 47.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Pipeline Shared Groovy Libraries PluginJenkins Pipeline
Timeline
PublishedFeb 15
Latest updateFeb 16

Description

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_pipeline_shared_groovy_libraries_pluginunspecified — 552.vd9cc05b8a2e1
▶NVDjenkins/pipeline552.vd9cc05b8a2e1

Patches

Patch: www.jenkins.io ↗Patch: www.jenkins.io ↗

🔴Vulnerability Details

3
OSV
Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin↗2022-02-16
▶
GHSA
Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin↗2022-02-16
▶
CVEList
CVE-2022-25178: Jenkins Pipeline: Shared Groovy Libraries Plugin 552↗2022-02-15
▶

📋Vendor Advisories

2
Red Hat
workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names↗2022-02-15
▶
Jenkins
Jenkins Security Advisory 2022-02-15↗2022-02-15
▶
CVE-2022-25178 — Path Traversal | cvebase