GitHub Advisoryadvisory · Maven

GHSA-6473-gqrj-4p65 Improper Link Resolution Before File Access in Jenkins Pipeline: Groovy Plugin

MEDIUM Published 2022-02-16 Modified 2023-05-30 Official page ↗
Aliases
CVE-2022-25176
Ecosystem
Maven
Packages
org.jenkins-ci.plugins.workflow:workflow-cps
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-59
Reviewed
2022-06-20

Affected packages

• Maven org.jenkins-ci.plugins.workflow:workflow-cps: >= 2.93, < 2.94.1 → fixed in 2.94.1 • Maven org.jenkins-ci.plugins.workflow:workflow-cps: < 2.92.1 → fixed in 2.92.1 • Maven org.jenkins-ci.plugins.workflow:workflow-cps: >= 2.95, < 2648.2651.v230593e03e9f → fixed in 2648.2651.v230593e03e9f

Description

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2022-25176 Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for… vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References