Skip to content
fr Sign in
Not rated

CVE-2022-25176 Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the…

Description

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.

Affected products and versions

Product Affected versions Fixed in
Jenkins Pipeline: Groovy Plugin 2648 earliest → 2648.va9433432b33c No fix stated
Jenkins Pipeline: Groovy Plugin 2.94 earliest → < 2.94.1 2.94.1
Jenkins Pipeline: Groovy Plugin 2.92 earliest → < 2.92.1 2.92.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Jenkins Pipeline: Groovy Plugin

The 11 CVEs of Jenkins Pipeline: Groovy Plugin →
CVE-2026-57284 Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated… 4.3 Medium CVE-2026-57283 A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier… 4.3 Medium CVE-2024-52550 Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether… 8.0 High CVE-2022-43402 A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins… Not rated
Track this CVE