Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-25183

27
FAUCET Score

CVE-2022-25183 affects Jenkins Pipeline: Shared Groovy Libraries Plugin versions 552.vd9cc05b8a2e1 and earlier. This vulnerability allows authenticated attackers with Item/Configure permissions to execute arbitrary code on the Jenkins controller JVM. It achieves this by exploiting unsanitized library names used for cache directory creation, provided a global Pipeline library with caching is already configured. The CVSS score of 8.8 (High) indicates a severe risk due to its low attack complexity and high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
<= 552.vd9cc05b8a2e1CPE matchmatch criteria
cpe:2.3:a:jenkins:pipeline\:shared_groovy_libraries:*:*:*:*:*:jenkins:*:*

CVSS Data

CVSS version used by this source: 3.1

8.8HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.57%
Probability of exploitation in next 30 days
EPSS Percentile
72.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0157 is in the 70th percentile among its peer group of 17,844 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (8)

jenkinspatch availablevia nvd_reference
View patch
mavenpatch availablevia ghsa
Product: org.jenkins-ci.plugins.workflow:workflow-cps-global-libFixed in: 561.va_ce0de3c2d69
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.10Fixed in: jenkins-2-plugins-0:4.10.1647505461-1.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.6Fixed in: jenkins-2-plugins-0:4.6.1650364520-1.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.7Fixed in: jenkins-2-plugins-0:4.7.1648800585-1.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.8Fixed in: jenkins-2-plugins-0:4.8.1646993358-1.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.9Fixed in: jenkins-2-plugins-0:4.9.1647580879-1.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 3.11Fixed in: jenkins-2-plugins-0:3.11.1650371376-1.el7
View patch

Vendor Advisories (2)

mavenGHSA-pfwp-q984-w7whhigh

Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure

Feb 16, 2022
redhatCVE-2022-25183Important

workflow-cps-global-lib: Sandbox bypass vulnerability

Feb 15, 2022

References

jenkins.io / security/advisory/2022-02-15
PatchVendor Advisory