PT-2022-17114 · Jenkins · Jenkins Pipeline: Multibranch Plugin+1

Daniel Beck · Published 2022-02-15 · Updated 2023-11-30 · CVE-2022-25175

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Multibranch Plugin versions 706.vd43c65dec013 and earlier

Description The issue allows attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents. This is possible due to the use of the same checkout directories for distinct SCMs for the readTrusted step.

Recommendations For Jenkins Pipeline: Multibranch Plugin versions 706.vd43c65dec013 and earlier, consider restricting access to the readTrusted step to minimize the risk of exploitation. As a temporary workaround, limit the permissions of users with Item/Configure access to prevent them from invoking arbitrary OS commands on the controller. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-25175

GHSA-PJ84-QJM3-77MG

RHSA-2022:0871

RHSA-2022:1021

RHSA-2022:1025

RHSA-2022:1248

RHSA-2022:1420

RHSA-2022:1620

Affected Products

Jenkins

Jenkins Pipeline: Multibranch Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2022-25175 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pj84-qjm3-77mg · Vendor Advisory
• https://jenkins.io/security/advisory/2022-02-15/#SECURITY-2463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25175 · Security Note
• https://github.com/jenkinsci/workflow-multibranch-plugin/commit/71c3f0a6ccdb2ba43f43686826b0d62160df85e8 · Note
• https://t.me/cvenotify/26832 · Telegram Post