CVE-2022-25173

2022-02-1516:10:50

jenkins

www.cve.org

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.9%

JSON

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

CNA Affected

[
  {
    "product": "Jenkins Pipeline: Groovy Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "2648.va9433432b33c",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "2.94.1"
      },
      {
        "status": "unaffected",
        "version": "2.92.1"
      }
    ]
  }
]