CVE Vulnerability

CVE-2022-29047

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951 Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:jenkins:pipeline:_shared_groovy_libraries:*:*:*:*:*:jenkins:*:*
cpe:2.3:a:jenkins:pipeline:_shared_groovy_libraries:*:*:*:*:*:jenkins:*:*
Information

Published : 2022-04-12 08:15

Updated : 2022-04-20 06:54

NVD link : CVE-2022-29047

Mitre link : CVE-2022-29047

Products Affected
No products.
CWE
CWE-863