Untrusted users can modify some Pipeline libraries in workflow-cps-global-lib

🗓️ 12 Apr 2022 00:00:00Reported by Jenkins Security TeamType

Untrusted users can alter pipeline behavior via library retriever in older global libraries; protections added later.

Reporter	Title	Published	Views	Family All 35
ATTACKERKB	CVE-2022-29047	12 Apr 202220:15	–	attackerkb
Circl	CVE-2022-29047	13 Apr 202200:17	–	circl
Tenable Nessus	Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.10 / 2.332.2.6 Multiple Vulnerabilities (CloudBees Security Advisory 2022-04-12)	16 May 202200:00	–	nessus
Tenable Nessus	Jenkins plugins Multiple Vulnerabilities (2022-04-12)	23 May 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.9.33 (RHSA-2022:2205)	19 May 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.7.52 paackages (RHSA-2022:4909)	8 Sep 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.8.56 (RHSA-2023:0017)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Developer Tools and Services for OCP 4.12 (RHSA-2023:1064)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.9.33 (RHSA-2022:2205)	6 May 202600:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.7.52 paackages (RHSA-2022:4909)	4 May 202600:00	–	nessus

Vulners

Node

jenkins workflow-cps-global-libRange<566.vd0a_a_3334a_555 or 2.21.3jenkins

12 Apr 2022 00:00Current

5.6Medium risk

Vulners AI Score5.6

CVSS 25

CVSS 3.15.3 - 7.3

EPSS0.01075

SSVC