Jenkins Pipeline Groovy Plugin Vulnerability Exposes File System
CVE-2022-25176

6.5MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Pipeline: Groovy Plugin
Vendor
CVE Published:
15 February 2022

What is CVE-2022-25176?

The Jenkins Pipeline Groovy Plugin prior to version 2648.va9433432b33c improperly validates the path to script files such as Jenkinsfile. By following symbolic links, the plugin allows unauthorized access to files outside the designated checkout directory. This could potentially enable attackers with pipeline configuration access to read sensitive files from the Jenkins controller's file system, posing significant security risks.

Affected Version(s)

Jenkins Pipeline: Groovy Plugin <= 2648.va9433432b33c

Jenkins Pipeline: Groovy Plugin 2.94.1

Jenkins Pipeline: Groovy Plugin 2.92.1

References

https://www.jenkins.io/security/advisory/2022-02-15/#SECU...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2022-25176 : Jenkins Pipeline Groovy Plugin Vulnerability Exposes File System