org.jenkins-ci.plugins.workflow:workflow-aggregator (1.0-beta-1) potentially affected by CVE-2022-25182 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.0-beta-1)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.0-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: -...

com.testinium.jenkins:testinium (1.0), org.jenkins-ci.plugins.workflow:workflow-aggregator (2.5) +9 more potentially affected by CVE-2022-25183 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (2.5)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: - com.testinium.jenkins:testinium 1.0 -...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.14.2), org.jvnet.hudson.plugins:analysis-test (1.20) potentially affected by CVE-2022-25182 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.14.2)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version 1.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps-global-lib and may be impacted: -...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25183 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25183 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25182 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25182 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +93 more potentially affected by CVE-2022-25180 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.92)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2022-25180 Source advisory:...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25177 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25177 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +93 more potentially affected by CVE-2022-25176 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.92)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2022-25176 Source advisory:...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.qasymphony.ci.jenkins:qtest (>=1.3.0, <=1.4.6) +38 more potentially affected by CVE-2022-25174 via org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (>=0.1-beta-5, <=2.17)

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib MAVEN version =0.1-beta-5, =1.9.2-beta, =1.3.0, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-rc2, =1.0.0-b15, =1.0.0-rc2, =1.0.0-rc2, =2.2.0, =1.0-alpha-1, =1.0-alpha-1, =1.0-alpha-1, =0.1-beta-5, =2.5 and more Source cves: CVE-2022-25174 Sour...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), com.logmein:pipeline-bamboo (>=0.0.1, <=0.0.2) +93 more potentially affected by CVE-2022-25173 via org.jenkins-ci.plugins.workflow:workflow-cps (>=0.1-beta-1, <=2.92)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version =0.1-beta-1, =1.9.2-beta, =0.0.1, =8.0.12, =0.8, =1.0.14, =1.3.0, =1.0, =0.9.0-beta-1, =1.0, =1.22, =y, =1.0.45 - io.fabric8.pipeline:kubernetes-pipeline-aggregator 1.3 and more Source cves: CVE-2022-25173 Source advisory:...

Sensitive information disclosure in workflow-cps

workflow-cps 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds. This allows attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline. workflow-cps 2656.vf7ae7b75a457 does not allow...

Sandbox bypass vulnerability in workflow-cps-global-lib

workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create directories without canonicalization or sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially...

Sandbox bypass vulnerability in workflow-cps-global-lib

workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization. This allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted...

Sandbox bypass vulnerability in workflow-cps-global-lib

workflow-cps-global-lib 552.vd9cc05b8a2e1 and earlier uses the same workspace directory for all checkouts of Pipeline libraries with the same name regardless of the SCM being used and the source of the library configuration. This allows attackers with Item/Configure permission to execute arbitrar...

com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.568) +24 more potentially affected by CVE-2022-20612 via org.jenkins-ci.main:jenkins-core (1.568)

org.jenkins-ci.main:jenkins-core MAVEN version 1.568 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso =1.2, =1.4 -...

Sandbox bypass via default method parameter expression in workflow-cps

Sandbox protection in workflow-cps 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods. This allows attackers able to specify and run sandboxed Pipelines to execute arbitrary code in the context of the Jenkins controller JVM. These expressions are...

Missing permission check in workflow-cps-global-lib

workflow-cps-global-lib provides form validation to determine whether the revision e.g. commit, tag, or branch name specified for a global library exists in the repository. This form validation method lacked a permission check, allowing attackers with Overall/Read access to determine whether an...

Arbitrary Code Execution

jenkins-plugin-workflow-cps is vulnerable to arbitrary code execution. A sandbox bypass in Script Security Plugin and Pipeline: Groovy Plugin allows an attacker to invoke arbitrary contructors in sandboxed scripts...

jenkins-plugin-workflow-cps: Sandbox bypass in Script Security Plugin and Pipeline: Groovy Plugin (SECURITY-1353)

A flaw was found in the Jenkins Workflow CPS plugin. Groovy Plugins could be circumvented through methods supporting type casts and type coercion allowing attackers to invoke constructors for arbitrary types. The highest threat from this vulnerability is to data confidentiality and integrity as...

jenkins-plugin-workflow-cps: Sandbox bypass in Pipeline: Groovy Plugin (SECURITY-1336(2))

A flaw was found in the Jenkins Workflow CPS plugin. Parsing, compilation, and script instantiations provided by a crafted Groovy script could escape the sandbox allowing users to execute arbitrary code on the Jenkins master. The highest risk from this vulnerability is to data confidentiality and...