Jenkins Pipeline:shared Groovy Libraries vulnerabilities

7 CVEs affecting Jenkins Pipeline:shared Groovy Libraries, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-25183, published 2022-02-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-25177, published 2022-02-15. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the…
CVE-2022-25178, published 2022-02-15. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure…
CVE-2022-25182, published 2022-02-15. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code on the…
CVE-2022-25181, published 2022-02-15. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the…
CVE-2022-25183, published 2022-02-15. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization, allowing attackers with…
CVE-2022-25174, published 2022-02-15. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure…
CVE-2019-10357, published 2019-07-31. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM…