CVE-2022-25179 — Link Following in Project Jenkins Pipeline Multibranch Plugin

CWE-59 — Link Following6 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
1.6%
top 18.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Pipeline Multibranch PluginJenkins Pipeline
Timeline
PublishedFeb 15
Latest updateFeb 16

Description

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_pipeline_multibranch_pluginunspecified — 706.vd43c65dec013
▶NVDjenkins/pipeline706.vd43c65dec013

Patches

Patch: www.jenkins.io ↗Patch: www.jenkins.io ↗

🔴Vulnerability Details

3
OSV
Link Following in Jenkins Pipeline Multibranch Plugin↗2022-02-16
▶
GHSA
Link Following in Jenkins Pipeline Multibranch Plugin↗2022-02-16
▶
CVEList
CVE-2022-25179: Jenkins Pipeline: Multibranch Plugin 706↗2022-02-15
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2022-02-15↗2022-02-15
▶
Red Hat
workflow-multibranch: Pipeline-related plugins follow symbolic links or do not limit path names↗2022-02-15
▶
CVE-2022-25179 — Link Following | cvebase