Untrusted users can modify some Pipeline libraries in Jenkins Pipeline: Deprecated Groovy Libraries Plugin

🗓️ 13 Apr 2022 00:00:17Reported by GitHub Advisory DatabaseType

Untrusted users in Jenkins Pipeline can abuse library retrieval to modify Pipeline behavior without commit acces

Reporter	Title	Published	Views	Family All 34
ATTACKERKB	CVE-2022-29047	12 Apr 202220:15	–	attackerkb
Circl	CVE-2022-29047	13 Apr 202200:17	–	circl
Tenable Nessus	Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.10 / 2.332.2.6 Multiple Vulnerabilities (CloudBees Security Advisory 2022-04-12)	16 May 202200:00	–	nessus
Tenable Nessus	Jenkins plugins Multiple Vulnerabilities (2022-04-12)	23 May 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.9.33 (RHSA-2022:2205)	19 May 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.7.52 paackages (RHSA-2022:4909)	8 Sep 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.8.56 (RHSA-2023:0017)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Developer Tools and Services for OCP 4.12 (RHSA-2023:1064)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.9.33 (RHSA-2022:2205)	6 May 202600:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.7.52 paackages (RHSA-2022:4909)	4 May 202600:00	–	nessus

Vulners

Node

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-29047
jenkins	www.jenkins.io/security/advisory/2022-04-12/
github	www.github.com/jenkinsci/workflow-cps-global-lib-plugin/commit/97bf32458e60ad252cfe5e7949bacf04459cee64
github	www.github.com/jenkinsci/workflow-cps-global-lib-plugin/commit/bae59b46cb524549d7f346ba73d3161804c97331
github	www.github.com/advisories/GHSA-hh6f-6fp5-gfpv

27 Jan 2023 05:08Current

5.7Medium risk

Vulners AI Score5.7

CVSS 25

CVSS 3.15.3

EPSS0.0008

SSVC