GitHub Advisoryadvisory · Maven

GHSA-pj84-qjm3-77mg Jenkins Pipeline: Multibranch Plugin vulnerable to OS Command Injection

HIGH Published 2022-02-16 Modified 2022-07-21 Official page ↗
Aliases
CVE-2022-25175
Ecosystem
Maven
Packages
org.jenkins-ci.plugins.workflow:workflow-multibranch
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2022-06-20

Affected packages

• Maven org.jenkins-ci.plugins.workflow:workflow-multibranch: < 707.v71c3f0a_6ccdb → fixed in 707.v71c3f0a_6ccdb

Description

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses distinct checkout directories per SCM for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

Related

Alias · CVE (1)

  • CVE-2022-25175 Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References