CVE-2022-25178

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-25178
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-25178.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-25178
Aliases
Downstream
Published
2022-02-15T17:15:08.837Z
Modified
2026-01-29T06:14:02.263713Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.

References

Affected packages

Git / github.com/jenkinsci/workflow-cps-global-lib-plugin

Affected ranges

Type
GIT
Repo
https://github.com/jenkinsci/workflow-cps-global-lib-plugin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d9cc05b8a2e175852b6fb5b5689333f88c837945

Affected versions

544.*
544.vff04fa68714d
545.*
545.v7b28cce323cf
548.*
548.v9085a486966a
552.*
552.vd9cc05b8a2e1
workflow-cps-global-lib-2.*
workflow-cps-global-lib-2.0
workflow-cps-global-lib-2.1
workflow-cps-global-lib-2.10
workflow-cps-global-lib-2.11
workflow-cps-global-lib-2.12
workflow-cps-global-lib-2.13
workflow-cps-global-lib-2.14
workflow-cps-global-lib-2.15
workflow-cps-global-lib-2.16
workflow-cps-global-lib-2.17
workflow-cps-global-lib-2.18
workflow-cps-global-lib-2.19
workflow-cps-global-lib-2.2
workflow-cps-global-lib-2.20
workflow-cps-global-lib-2.21
workflow-cps-global-lib-2.3
workflow-cps-global-lib-2.4
workflow-cps-global-lib-2.5
workflow-cps-global-lib-2.6
workflow-cps-global-lib-2.7
workflow-cps-global-lib-2.8
workflow-cps-global-lib-2.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-25178.json"