org.jenkins-ci.plugins.workflow:workflow-cps
Maven13 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting org.jenkins-ci.plugins.workflow:workflow-cpspage 1 of 1
- CVE-2017-1000096HIGHCVSS 8.8EG 8.8fixed in 2.36.12017-10-05
vulnerable: 0.1-beta-1 ... 2.9 (86 versions)
Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. …
- CVE-2018-1000866HIGHCVSS 8.8EG 8.8fixed in 2.602018-12-10
vulnerable: 0.1-beta-1 ... 2.9 (122 versions)
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransform…
- CVE-2019-1003030CRITICALCVSS 9.9EG 9.9⚠ KEVfixed in 2.642019-03-08
vulnerable: 0.1-beta-1 ... 2.9 (129 versions)
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute ar…
- CVE-2019-1003041CRITICALCVSS 9.8EG 9.8fixed in 2.652019-03-28
vulnerable: 0.1-beta-1 ... 2.9 (130 versions)
A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
- CVE-2020-2109HIGHCVSS 8.8EG 8.8fixed in 2.792020-02-12
vulnerable: 0.1-beta-1 ... 2.9 (146 versions)
Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.
- CVE-2022-25173HIGHCVSS 8.8EG 8.8fixed in 2656.vf7a, 2.94.1 or 2.92.1, by version range2022-02-15
vulnerable: 0.1-beta-1 ... 2.92 (160 versions)
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to in…
- CVE-2022-25176MEDIUMCVSS 6.5EG 6.5fixed in 2.94.1, 2.92.1 or 2648.2651.v230593e03e9f, by version range2022-02-15
vulnerable: 2633.v6baeedc13805, 2640.v00e79c8113de, 2644.v29a793dac95a, 2646.v6ed3b5b01ff1, 2648.va9433432b33c
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attack…
- CVE-2022-25180MEDIUMCVSS 4.3EG 4.3fixed in 2656.vf7a_e7b_75a_4572022-02-15
vulnerable: 0.1-beta-1 ... 2648.va9433432b33c (171 versions)
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password parameters passed to pre…
- CVE-2022-30945HIGHCVSS 8.5EG 8.5fixed in 2692.v76b2022-05-17
vulnerable: 0.1-beta-1 ... 2689.v434009a_31b_f1 (183 versions)
Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines.
- CVE-2022-43401CRITICALCVSS 9.9EG 9.9fixed in 2803.v1a_f77ffcc7732022-10-19
vulnerable: 0.1-beta-1 ... 2802.v5ea_628154b_c2 (197 versions)
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed sc…
- CVE-2022-43402CRITICALCVSS 9.9EG 9.9fixed in 2803.v1a_f77ffcc7732022-10-19
vulnerable: 0.1-beta-1 ... 2802.v5ea_628154b_c2 (197 versions)
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scr…
- CVE-2022-43404CRITICALCVSS 9.9EG 9.9fixed in 2803.v1a_f77ffcc7732022-10-19
vulnerable: 0.1-beta-1 ... 2802.v5ea_628154b_c2 (197 versions)
A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and r…
- CVE-2024-52550HIGHCVSS 8.0EG 8.0fixed in 3993.v3e20a2024-11-13
vulnerable: 0.1-beta-1 ... 3990.vd281dd77a_388 (271 versions)
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild …
Check whether org.jenkins-ci.plugins.workflow:workflow-cps is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.jenkins-ci.plugins.workflow:workflow-cps CVEs against the assets you own.
Book a Demo →