CVE-2022-25181 — Vulnetix

Try Vulnetix Request Demo

CVE-2022-25181 PUBLISHED CVSS 8.800000190734863 HIGH

A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global Pipeline library already exists.

EPSS 0.29% · 52.4th percentile

Risk Scores

CVSS v3.1

8.800000190734863

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.29%

52.4th percentile

Affected Products

Vendor	Product	Versions
Jenkins project	Jenkins Pipeline: Shared Groovy Libraries Plugin	2.21.1, 2.18.1, *
jenkins	pipeline\	shared_groovy_libraries
Maven	org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	0

Timeline

Feb 15, 2022 CVE Published
Feb 15, 2022 PoC Published
Feb 16, 2022 EPSS Score
Apr 9, 2022 EPSS Score
May 30, 2022 EPSS Score
Jun 20, 2022 CVE Updated
Jul 22, 2022 EPSS Score
Sep 11, 2022 EPSS Score
Nov 2, 2022 EPSS Score
Dec 24, 2022 EPSS Score
Feb 13, 2023 EPSS Score
Mar 7, 2023 EPSS Score

References

Open in Interactive Console →