CVE-2022-25175

Description

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

CVSS Metrics

• v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• v2.0•MEDIUM•Score: 6.5AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.42%• Percentile: 62%

Techniques & Countermeasures

• CWE-78•Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected Systems

• jenkins project•jenkins pipeline: multibranch plugin

  ≥ unspecified, ≤ 706.vd43c65dec013

• org.jenkins-ci.plugins.workflow•workflow-multibranch

  < 707.v71c3f0a_6ccdb

References (3)

• https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2463
• https://nvd.nist.gov/vuln/detail/CVE-2022-25175
• https://github.com/jenkinsci/workflow-multibranch-plugin/commit/71c3f0a6ccdb2ba43f43686826b0d62160df85e8