What is GHSA-5hfv-mg5x-mv32?

GHSA-5hfv-mg5x-mv32 is a security advisory published by GitHub Security Advisories with Medium severity. Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin

Which CVE IDs does GHSA-5hfv-mg5x-mv32 cover?

GHSA-5hfv-mg5x-mv32 covers the following CVE IDs: CVE-2022-25178. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5hfv-mg5x-mv32?

GHSA-5hfv-mg5x-mv32 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-5hfv-mg5x-mv32?

GHSA-5hfv-mg5x-mv32 affects 3 products, including: maven/org.jenkins-ci.plugins.workflow:workflow-cps-global-lib:\u003e= 2.22, \u003c= 552.vd9cc05b8a2e1; maven/org.jenkins-ci.plugins.workflow:workflow-cps-global-lib:\u003e= 2.19, \u003c 2.21.1; maven/org.jenkins-ci.plugins.workflow:workflow-cps-global-lib:\u003c 2.18.1.

GHSA-5hfv-mg5x-mv32MediumCVSS 6.5

Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin

Vendor

GitHub Security Advisories

Published

February 16, 2022

Last Modified

May 31, 2023

🔗 CVE IDs covered (1)

CVE-2022-25178 →

📋 Description

Jenkins Pipeline: Shared Groovy Libraries Plugin does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.

🎯 Affected products3

maven/org.jenkins-ci.plugins.workflow:workflow-cps-global-lib:>= 2.22, <= 552.vd9cc05b8a2e1
maven/org.jenkins-ci.plugins.workflow:workflow-cps-global-lib:>= 2.19, < 2.21.1
maven/org.jenkins-ci.plugins.workflow:workflow-cps-global-lib:< 2.18.1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-25178
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2613
https://github.com/advisories/GHSA-5hfv-mg5x-mv32