CVE-2022-25175

Name
CVE-2022-25175
Description
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses distinct checkout directories per SCM for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
NVD Severity
high
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
CONFIRM https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2463

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:jenkins:pipeline\:_multibranch:*:*:*:*:*:jenkins:*:* jenkins >= None <= 706.vd43c65dec013

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
jenkins 3.15-community 2.319.3-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins edge-community 2.332.3-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
jenkins 3.16-community 2.332.3-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable