CVE-2022-25174 — Vulnetix

CVE-2022-25174 PUBLISHED CVSS 8.800000190734863 HIGH

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

EPSS 0.22% · 44.6th percentile

Risk Scores

CVSS 3.1

8.800000190734863

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.22%

44.6th percentile

Affected Products

Vendor	Product	Versions
jenkins	pipeline\	shared_groovy_libraries
Maven	org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	544.vff04fa68714d, 2.19, 0
Jenkins project	Jenkins Pipeline: Shared Groovy Libraries Plugin	2.21.1, unspecified, 2.18.1

Exploit Intelligence

shoucheng3/jenkinsci__workflow-cps-global-lib-plugin_CVE-2022-25174_544-vff04fa68714d (github-poc)
shoucheng3/jenkinsci__workflow-cps-global-lib-plugin_CVE-2022-25174_544-vff04fa68714d (github-poc)
shoucheng3/jenkinsci__workflow-cps-global-lib-plugin_CVE-2022-25174_544-vff04fa68714d (github-poc)
shoucheng3/jenkinsci__workflow-cps-global-lib-plugin_CVE-2022-25174_544-vff04fa68714d (github-poc)
shoucheng3/jenkinsci__workflow-cps-global-lib-plugin_CVE-2022-25174_544-vff04fa68714d (github-poc)
CIRCL seen: CVE-2022-25174 (circl-sighting)
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2463 (circl)

Timeline

Feb 15, 2022 CVE Published
Feb 16, 2022 EPSS Score
Apr 9, 2022 EPSS Score
Jun 20, 2022 CVE Updated
Jul 24, 2022 EPSS Score
Sep 14, 2022 EPSS Score
Nov 5, 2022 EPSS Score
Dec 27, 2022 EPSS Score
Mar 7, 2023 EPSS Score
Apr 10, 2023 EPSS Score
Jun 2, 2023 EPSS Score
Jul 24, 2023 EPSS Score

References

Open in Interactive Console →