~ / search / GHSA-pj84-qjm3-77mg

GHSA-pj84-qjm3-77mg

Jenkins Pipeline: Multibranch Plugin vulnerable to OS Command Injection

Source: GitHub Advisory Database (reviewed) High CVE-2022-25175

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins.workflow:workflow-multibranch < 707.v71c3f0a_6ccdb 707.v71c3f0a_6ccdb

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses distinct checkout directories per SCM for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

References

External links from the advisory. They lead to third-party sites.