Arbitrary File Reading in Jenkins Pipeline Due to Shared Groovy Libraries Plugin Vulnerability
CVE-2022-25178

6.5MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Pipeline: Shared Groovy Libraries Plugin
Vendor
CVE Published:
15 February 2022

Summary

The Shared Groovy Libraries Plugin in Jenkins fails to adequately restrict resource names passed to the libraryResource step. This flaw allows attackers with Pipeline configuration permissions to read any file on the Jenkins controller's file system, potentially exposing sensitive information and compromising the system.

Affected Version(s)

Jenkins Pipeline: Shared Groovy Libraries Plugin <= 552.vd9cc05b8a2e1

Jenkins Pipeline: Shared Groovy Libraries Plugin 2.21.1

Jenkins Pipeline: Shared Groovy Libraries Plugin 2.18.1

References

https://www.jenkins.io/security/advisory/2022-02-15/#SECU...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.