Published: 12/04/2022 Updated: 21/12/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 5.3 | Impact Score: 1.4 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and previous versions, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.

Vulnerable Product	Search on Vulmon	Subscribe to Product
jenkins pipeline\\ _shared_groovy_libraries

Synopsis Important: OpenShift Container Platform 4752 paackages and security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Container Platform release 4752 is now available withupdates to pac ...

Synopsis Important: OpenShift Container Platform 4856 packages and security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Container Platform release 4856 is now available withupdates to pack ...

Synopsis Important: OpenShift Container Platform 4933 packages and security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Container Platform release 4933 is now available withupdates to pack ...

Synopsis Critical: OpenShift Developer Tools and Services for OCP 412 security update Type/Severity Security Advisory: Critical Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for Jenkins and Jenkins-2-plugins is now available for OpenShift Developer To ...

Jenkins Pipeline: Shared Groovy Libraries Plugin 564ve62a_4eb_b_e039 and earlier, except 2213, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even ...

CWE-863 https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-1951 https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2022:4909

CVE-2022-29047

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect