CVE-2022-25175

Summary

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

Affected Software

VendorProductVersion RangeStatus
Jenkins projectJenkins Pipeline: Multibranch Plugin2.26.1unaffected
Jenkins projectJenkins Pipeline: Multibranch Plugin2.23.1unaffected
Jenkins projectJenkins Pipeline: Multibranch Plugin696.698.v9b4218eea50funaffected
Jenkins projectJenkins Pipeline: Multibranch Pluginunspecified <= 706.vd43c65dec013affected

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

References