Jenkins Pipeline: Multibranch Plugin vulnerable to OS Command Injection

높음 8.8CVE-2022-25175 · GHSA-pj84-qjm3-77mg · Published 15/02/2022 · updated 17/06/2026

요약

CVE-2022-25175은(는) org.jenkins-ci.plugins.workflow:workflow-multibranch, pipeline (jenkins)에 영향을 주는 높음 (CVSS 8.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.4%, 전체 취약점의 72.7%보다 높음.
조치: 707.v71c3f0a_6ccdb 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins.workflow:workflow-multibranch Maven	`< 707.v71c3f0a_6ccdb`	`707.v71c3f0a_6ccdb`
pipeline jenkins	`≤ 706.vd43c65dec013`	No fix yet

Description

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses distinct checkout directories per SCM for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

NVD description

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

References

nvd.nist.gov/vuln/detail/CVE-2022-25175 · ADVISORY
jenkinsci/workflow-multibranch-plugin commit 71c3f0a · WEB
jenkins.io/security/advisory/2022-02-15 · WEB

org.jenkins-ci.plugins.workflow:workflow-multibranch의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins.workflow:workflow-multibranch

Maven

< 707.v71c3f0a_6ccdb

707.v71c3f0a_6ccdb

pipeline

jenkins

≤ 706.vd43c65dec013

No fix yet

Description

NVD description