ChainJenkins Pipeline: Shared Groovy Libraries PluginMaven:org.jenkins-ci.plugins.workflow:workflow-cps-global-lib
Jenkins Pipeline: Shared Groovy Libraries Plugin: successive fixes (2022)
5 CVEs over 2 generations, 15 Feb 2022 to 12 Apr 2022.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2022-2517415 Feb 2022 First in the chain
- CVE-2022-2518115 Feb 2022 No direct link to an earlier CVE
- CVE-2022-2518215 Feb 2022 No direct link to an earlier CVE
- CVE-2022-2518315 Feb 2022 No direct link to an earlier CVE
- CVE-2022-2904712 Apr 2022 related to CVE-2022-25174related to CVE-2022-25181and 2 more
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2022-25174 | 15 Feb 2022 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for… · fixed in 561.va | First in chain | 14.5 |
| CVE-2022-25181 | 15 Feb 2022 | A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier… · fixed in 561.va_ce0de3c2d69 | First in chain | 15.2 |
| CVE-2022-25182 | 15 Feb 2022 | A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier… · fixed in 561.va_ce0de3c2d69 | First in chain | 15.2 |
| CVE-2022-25183 | 15 Feb 2022 | Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to… · fixed in 561.va_ce0de3c2d69 | First in chain | 15.1 |
| CVE-2022-29047 | 12 Apr 2022 | Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers… · fixed in 566.vd0a | CVE-2022-25174 · related · High | 13.6 |