Improper Validation in Shared Groovy Libraries Plugin for Jenkins

CVE-2022-29047

Summary

The Shared Groovy Libraries Plugin for Jenkins allows attackers, who can submit pull requests but cannot commit directly to the source code management (SCM) system, to alter the pipeline behavior. This is achieved by modifying the definition of a dynamically retrieved library within their pull request. Even if the pipeline is set to distrust these external submissions, the lack of proper validation enables the potential exploitation of this vulnerability, allowing unauthorized control over the pipeline execution.

References