Jenkins Pipeline: Multibranch vulnerabilities

2 CVEs affecting Jenkins Pipeline: Multibranch, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-25179, published 2022-02-15.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-25179, published 2022-02-15. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the…
• CVE-2022-25175, published 2022-02-15. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to…