Lucene search

K
osvGoogleOSV:GHSA-Q234-X887-9RXH
HistoryFeb 16, 2022 - 12:01 a.m.

Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin

2022-02-1600:01:35
Google
osv.dev
12
jenkins
pipeline
shared groovy libraries plugin
file access
security issue

EPSS

0.001

Percentile

28.4%

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.

EPSS

0.001

Percentile

28.4%