CVE-2022-25179
CVE-2022-25179
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.8%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
15 Feb 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
Affected products
Jenkins project · Jenkins Pipeline: Multibranch PluginWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →