Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Shared Groovy Libraries Plugin
High severity
GitHub Reviewed
Published
Feb 16, 2022
to the GitHub Advisory Database
•
Updated Dec 22, 2023
Package
Affected versions
>= 544.vff04fa68714d, < 561.va
>= 2.19, < 2.21.1
< 2.18.1
Patched versions
561.va
2.21.1
2.18.1
Description
Published by the National Vulnerability Database
Feb 15, 2022
Published to the GitHub Advisory Database
Feb 16, 2022
Reviewed
Jun 20, 2022
Last updated
Dec 22, 2023
Credits
-
westonsteimel Analyst
Jenkins Pipeline: Shared Groovy Libraries Plugin prior to 561.va_ce0de3c2d69, 2.21.1, and 2.18.1 uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
References