workflow-cps-global-lib: Sandbox bypass vulnerability

🗓️ 27 Apr 2022 07:44:06Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

Sandbox bypass in Jenkins libraries: unsanitized names allow code execution on controller.

Reporter	Title	Published	Views	Family All 48
ATTACKERKB	CVE-2022-25182	15 Feb 202217:15	–	attackerkb
AlpineLinux	CVE-2022-25182	15 Feb 202216:11	–	alpinelinux
Tenable Nessus	Jenkins Enterprise and Operations Center 2.277.x < 2.277.43.0.7 / 2.303.x < 2.303.30.0.6 / 2.319.3.4 Multiple Vulnerabilities (CloudBees Security Advisory 2022-02-15)	8 Mar 202200:00	–	nessus
Tenable Nessus	Jenkins plugins Multiple Vulnerabilities (2022-02-15)	13 Jun 202200:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : OpenShift Container Platform 4.8.35 (RHSA-2022:0871)	23 Mar 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.9.26 (RHSA-2022:1021)	29 Mar 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.10.6 (RHSA-2022:1025)	29 Mar 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.7.48 (RHSA-2022:1248)	13 Apr 202200:00	–	nessus
Tenable Nessus	RHEL 7 : OpenShift Container Platform 3.11.685 (RHSA-2022:1420)	27 Apr 202200:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : OpenShift Container Platform 4.6.57 (RHSA-2022:1620)	4 May 202200:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	noarch	jenkins-2-plugins	3.11.1650371376-1.el7	jenkins-2-plugins-3.11.1650371376-1.el7.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-25182
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-25182
cve	www.cve.org/CVERecord

21 Mar 2026 04:24Current

6.1Medium risk

Vulners AI Score6.1

CVSS 26.5

CVSS 3.18.8

EPSS0.01601

SSVC

jenkins pipeline libraries sandbox bypass code execution unsanitized library names