Path traversal vulnerability in pipeline-groovy-lib

pipeline-groovy-lib provides the library step to retrieve a shared library from an SCM, using a library path to specify the directory containing the library inside the SCM checkout. pipeline-groovy-lib 805.vafc79344957d and earlier does not restrict that library path to a relative path inside the...

CSRF vulnerability in pipeline-groovy-lib

pipeline-groovy-lib 798.v5cc688825312 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to delete shared library caches. pipeline-groovy-lib 805.vafc79344957d requires POST requests fo...

Arbitrary file read vulnerability through symbolic links in pipeline-groovy-lib

pipeline-groovy-lib 797.v90eaa9be45a0 and earlier does not prohibit symbolic links in shared libraries. This allows attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem. pipeline-groovy-lib 798.v5cc688825312 prohibi...

CVE-2021-23259

Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotelyRCE...