VULNERABILITY INTELLIGENCE

CVE-2022-25178

CVSS score6.5 MEDIUM

EPSS probability1.67%

CISA KEVNot currently listed

Published2022-02-15

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.

Weakness classification

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references

jenkinsci-cert@googlegroups.com — Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory