Jenkins Matrix Project Plugin Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/03/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins.workflow:workflow-cps | < 2.64 | 2.64 |
| pipeline | ≤ 2.63 | |
| openshift container platform | = 3.11 |
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free