CVE-2022-25183 affects Jenkins Pipeline: Shared Groovy Libraries Plugin versions 552.vd9cc05b8a2e1 and earlier. This vulnerability allows authenticated attackers with Item/Configure permissions to execute arbitrary code on the Jenkins controller JVM. It achieves this by exploiting unsanitized library names used for cache directory creation, provided a global Pipeline library with caching is already configured. The CVSS score of 8.8 (High) indicates a severe risk due to its low attack complexity and high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 552.vd9cc05b8a2e1CPE matchmatch criteria | cpe:2.3:a:jenkins:pipeline\:shared_groovy_libraries:*:*:*:*:*:jenkins:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.