CVE-2022-25178 — Vulnetix

Try Vulnetix Request Demo

CVE-2022-25178 PUBLISHED CVSS 6.5 MEDIUM

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.

EPSS 0.30% · 52.7th percentile

Risk Scores

CVSS v3.1

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

0.30%

52.7th percentile

Affected Products

Vendor	Product	Versions
Jenkins project	Jenkins Pipeline: Shared Groovy Libraries Plugin	2.21.1, 2.18.1, unspecified
jenkins	pipeline\	shared_groovy_libraries
Maven	org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	2.22, 2.19, 0

Timeline

Feb 15, 2022 CVE Published
Feb 15, 2022 PoC Published
Feb 16, 2022 EPSS Score
Apr 9, 2022 EPSS Score
May 30, 2022 EPSS Score
Jun 20, 2022 CVE Updated
Jul 22, 2022 EPSS Score
Sep 11, 2022 EPSS Score
Nov 2, 2022 EPSS Score
Dec 24, 2022 EPSS Score
Feb 13, 2023 EPSS Score
Mar 7, 2023 EPSS Score

References

Open in Interactive Console →