PT-2022-17117 · Jenkins · Jenkins Pipeline: Shared Groovy Libraries Plugin+1

Published 2022-02-15 · Updated 2023-11-30 · CVE-2022-25178

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline: Shared Groovy Libraries Plugin versions 552.vd9cc05b8a2e1 and earlier

Description The issue allows attackers with permission to configure Pipelines to read arbitrary files on the Jenkins controller file system. This is due to the lack of restriction on the names of resources passed to the libraryResource step.

Recommendations For versions 552.vd9cc05b8a2e1 and earlier, consider restricting access to the libraryResource step until a patch is available. As a temporary workaround, limit the configuration of Pipelines to trusted users to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-25178

GHSA-5HFV-MG5X-MV32

RHSA-2022:0871

RHSA-2022:1021

RHSA-2022:1025

RHSA-2022:1248

RHSA-2022:1420

RHSA-2022:1620

Affected Products

Jenkins

Jenkins Pipeline: Shared Groovy Libraries Plugin

References · 9

• https://osv.dev/vulnerability/CVE-2022-25178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25178 · Security Note
• https://jenkins.io/security/advisory/2022-02-15/#SECURITY-2613 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5hfv-mg5x-mv32 · Vendor Advisory
• https://github.com/jenkinsci/workflow-cps-global-lib-plugin · Note
• https://t.me/cibsecurity/37515 · Telegram Post
• https://t.me/cvenotify/27257 · Telegram Post
• https://t.me/cvenotify/61759 · Telegram Post
• https://t.me/cvenotify/26830 · Telegram Post