CVE-2022-25173 — Vulnetix

CVE-2022-25173 PUBLISHED CVSS 8.800000190734863 HIGH

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

EPSS 0.18% · 40.0th percentile

Risk Scores

CVSS 3.1

8.800000190734863

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.18%

40.0th percentile

Affected Products

Vendor	Product	Versions
jenkins	pipeline\	_groovy
Jenkins project	Jenkins Pipeline: Groovy Plugin	unspecified, 2.92.1, 2.94.1
Maven	org.jenkins-ci.plugins.workflow:workflow-cps	*, 2.93, 0

Exploit Intelligence

shoucheng3/jenkinsci__workflow-cps-plugin_CVE-2022-25173_2646-v6ed3b5b01ff1 (github-poc)
shoucheng3/jenkinsci__workflow-cps-plugin_CVE-2022-25173_2646-v6ed3b5b01ff1 (github-poc)
shoucheng3/jenkinsci__workflow-cps-plugin_CVE-2022-25173_2646-v6ed3b5b01ff1 (github-poc)
shoucheng3/jenkinsci__workflow-cps-plugin_CVE-2022-25173_2646-v6ed3b5b01ff1 (github-poc)
shoucheng3/jenkinsci__workflow-cps-plugin_CVE-2022-25173_2646-v6ed3b5b01ff1 (github-poc)
CIRCL seen: CVE-2022-25173 (circl-sighting)
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2463 (circl)
[oss-security] 20220215 Multiple vulnerabilities in Jenkins plugins (circl)

Timeline

Feb 15, 2022 CVE Published
Feb 16, 2022 EPSS Score
Apr 9, 2022 EPSS Score
May 31, 2022 EPSS Score
Jun 20, 2022 CVE Updated
Sep 14, 2022 EPSS Score
Nov 5, 2022 EPSS Score
Dec 27, 2022 EPSS Score
Feb 17, 2023 EPSS Score
Apr 10, 2023 EPSS Score
Jun 2, 2023 EPSS Score
Jul 24, 2023 EPSS Score

References

Open in Interactive Console →