6.5
CVE-2022-25177
- EPSS 0.64%
- Veröffentlicht 15.02.2022 17:15:08
- Zuletzt bearbeitet 21.11.2024 06:51:45
- Quelle jenkinsci-cert@googlegroups.co
- Teams Watchlist Login
- Unerledigt Login
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jenkins ≫ Pipeline:shared Groovy Libraries SwPlatformjenkins Version <= 552.vd9cc05b8a2e1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.64% | 0.697 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| nvd@nist.gov | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:P/I:N/A:N
|
CWE-59 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.