CVE-2022-25182

A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller JVM using specially crafted library names if a global Pipeline library is already configured.

Published: Feb 15, 2022
Updated: Oct 26, 2023
CVE: CVE-2022-25182
GHSA: GHSA-7rcw-fwfh-2h2g
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P

CWEs:

CWE-693

Affected Software
References

Software	From	Fixed in
jenkins / pipeline-shared_groovy_libraries	-	552.vd9cc05b8a2e1.x
org.jenkins-ci.plugins.workflow / workflow-cps-global-lib	-	561.va_ce0de3c2d69

https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2422

Vulnerability Database

289,697

CVE-2022-25182