File Reading Vulnerability in Jenkins Pipeline with Shared Groovy Libraries Plugin
CVE-2022-25177

6.5MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Pipeline: Shared Groovy Libraries Plugin
Vendor
CVE Published:
15 February 2022

Summary

The Shared Groovy Libraries Plugin for Jenkins Pipeline is susceptible to a vulnerability that involves following symbolic links to unexpected file locations when accessing files through the libraryResource step. This flaw permits attackers who have configured Pipelines to read arbitrary files from the Jenkins controller's file system, potentially leading to unauthorized information disclosure.

Affected Version(s)

Jenkins Pipeline: Shared Groovy Libraries Plugin <= 552.vd9cc05b8a2e1

Jenkins Pipeline: Shared Groovy Libraries Plugin 2.21.1

Jenkins Pipeline: Shared Groovy Libraries Plugin 2.18.1

References

https://www.jenkins.io/security/advisory/2022-02-15/#SECU...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.