Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin

中危 6.5CVE-2022-25178 · GHSA-5hfv-mg5x-mv32 · Published 15/02/2022 · updated 17/06/2026

要点

CVE-2022-25178 是影响 org.jenkins-ci.plugins.workflow:workflow-cps-global-lib, pipeline (jenkins) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：1.7%，高于 76.8% 的漏洞。
修复：升级到 2.21.1, 561.va_ce0de3c2d69, 2.18.1 或更高版本。

Package	Affected versions	Patched versions
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib Maven	`≥ 2.19, < 2.21.1≥ 2.22, < 561.va_ce0de3c2d69< 2.18.1`	`2.21.1561.va_ce0de3c2d692.18.1`
pipeline jenkins	`≤ 552.vd9cc05b8a2e1`	No fix yet

Description

Jenkins Pipeline: Shared Groovy Libraries Plugin does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.

NVD description

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.

References

nvd.nist.gov/vuln/detail/CVE-2022-25178 · ADVISORY
jenkinsci/workflow-cps-global-lib-plugin · PACKAGE
jenkins.io/security/advisory/2022-02-15 · WEB

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib

Maven

≥ 2.19, < 2.21.1≥ 2.22, < 561.va_ce0de3c2d69< 2.18.1

2.21.1561.va_ce0de3c2d692.18.1

pipeline

jenkins

≤ 552.vd9cc05b8a2e1

No fix yet

Description

NVD description

org.jenkins-ci.plugins.workflow:workflow-cps-global-lib 的其他漏洞

查看全部 →