Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin

🗓️ 12 Jan 2023 16:49:54Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 11 Views

Jenkins Shared Groovy Libraries flaw lets untrusted users modify dynamic libraries via pull requests

Reporter	Title	Published	Views	Family All 36
ATTACKERKB	CVE-2022-29047	12 Apr 202220:15	–	attackerkb
Circl	CVE-2022-29047	13 Apr 202200:17	–	circl
Tenable Nessus	Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.10 / 2.332.2.6 Multiple Vulnerabilities (CloudBees Security Advisory 2022-04-12)	16 May 202200:00	–	nessus
Tenable Nessus	Jenkins plugins Multiple Vulnerabilities (2022-04-12)	23 May 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.9.33 (RHSA-2022:2205)	19 May 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.7.52 paackages (RHSA-2022:4909)	8 Sep 202200:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Container Platform 4.8.56 (RHSA-2023:0017)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : OpenShift Developer Tools and Services for OCP 4.12 (RHSA-2023:1064)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.9.33 (RHSA-2022:2205)	6 May 202600:00	–	nessus
Tenable Nessus	RHCOS 4 : OpenShift Container Platform 4.7.52 paackages (RHSA-2022:4909)	4 May 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	jenkins-2-plugins	4.8.1672842762-1.el8	jenkins-2-plugins-4.8.1672842762-1.el8.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-29047
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-29047
cve	www.cve.org/CVERecord
jenkins	www.jenkins.io/security/advisory/2022-04-12/

21 Mar 2026 04:22Current

5.8Medium risk

Vulners AI Score5.8

CVSS 25

CVSS 3.15.3

EPSS0.01116

SSVC

untrusted users dynamic libraries pull requests pipeline behavior shared groovy libraries