{"containers": {"cna": {"affected": [{"product": "Jenkins Pipeline: Shared Groovy Libraries Plugin", "vendor": "Jenkins project", "versions": [{"lessThanOrEqual": "552.vd9cc05b8a2e1", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"status": "unaffected", "version": "2.21.1"}, {"status": "unaffected", "version": "2.18.1"}]}], "descriptions": [{"lang": "en", "value": "Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system."}], "providerMetadata": {"orgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "shortName": "jenkins", "dateUpdated": "2023-10-24T14:19:35.550Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2613"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "jenkinsci-cert@googlegroups.com", "ID": "CVE-2022-25178", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Jenkins Pipeline: Shared Groovy Libraries Plugin", "version": {"version_data": [{"version_affected": "<=", "version_value": "552.vd9cc05b8a2e1"}, {"version_affected": "!", "version_value": "2.21.1"}, {"version_affected": "!", "version_value": "2.18.1"}]}}]}, "vendor_name": "Jenkins project"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}]}, "references": {"reference_data": [{"name": "https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2613", "refsource": "CONFIRM", "url": "https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2613"}]}}}}, "cveMetadata": {"assignerOrgId": "39769cd5-e6e2-4dc8-927e-97b3aa056f5b", "assignerShortName": "jenkins", "cveId": "CVE-2022-25178", "datePublished": "2022-02-15T16:10:58", "dateReserved": "2022-02-15T00:00:00", "dateUpdated": "2023-10-24T14:19:35.550Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:pipeline\\:shared_groovy_libraries:*:*:*:*:*:jenkins:*:*", "matchCriteriaId": "7710DFDC-CED2-46CA-A221-8F025DF48358", "versionEndIncluding": "552.vd9cc05b8a2e1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system."}, {"lang": "es", "value": "Jenkins Pipeline: Shared Groovy Libraries Plugin versiones 552.vd9cc05b8a2e1 y anteriores, no restringen los nombres de los recursos pasados al paso libraryResource, permitiendo a atacantes capaces de configurar el permiso de Pipelines para leer archivos arbitrarios en el sistema de archivos del controlador de Jenkins"}], "id": "CVE-2022-25178", "lastModified": "2023-11-30T18:59:36.370", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-02-15T17:15:08.837", "references": [{"source": "jenkinsci-cert@googlegroups.com", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2613"}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}