Maven package
org.jenkins-ci.plugins.workflow/workflow-cps
pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps
Vulnerabilities (13)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-52550 | — | < 3993.v3e20a | 3993.v3e20a | Nov 13, 2024 | Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) scri | ||
| CVE-2022-43404 | — | < 2803.v1a_f77ffcc773 | 2803.v1a_f77ffcc773 | Oct 19, 2022 | A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines | ||
| CVE-2022-43402 | — | < 2803.v1a_f77ffcc773 | 2803.v1a_f77ffcc773 | Oct 19, 2022 | A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the | ||
| CVE-2022-43401 | — | < 2803.v1a_f77ffcc773 | 2803.v1a_f77ffcc773 | Oct 19, 2022 | A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the | ||
| CVE-2022-30945 | — | < 2692.v76b | 2692.v76b | May 17, 2022 | Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines. | ||
| CVE-2022-25180 | — | < 2656.vf7a_e7b_75a_457 | 2656.vf7a_e7b_75a_457 | Feb 15, 2022 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline. | ||
| CVE-2022-25176 | — | >= 2.93, < 2.94.1 | 2.94.1 | Feb 15, 2022 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configure Pipelines to read a | ||
| CVE-2022-25173 | — | >= 2646.v6ed3b5b01ff1, < 2656.vf7a | 2656.vf7a | Feb 15, 2022 | Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the control | ||
| CVE-2020-2109 | — | < 2.79 | 2.79 | Feb 12, 2020 | Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods. | ||
| CVE-2019-1003041 | — | < 2.65 | 2.65 | Mar 28, 2019 | A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. | ||
| CVE-2019-1003030 | — | KEV | < 2.64 | 2.64 | Mar 8, 2019 | A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM. | |
| CVE-2018-1000866 | — | < 2.60 | 2.60 | Dec 10, 2018 | A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Co | ||
| CVE-2017-1000096 | Hig | 8.8 | < 2.36.1 | 2.36.1 | Oct 5, 2017 | Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular J |
- CVE-2024-52550Nov 13, 2024affected < 3993.v3e20afixed 3993.v3e20a
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) scri
- CVE-2022-43404Oct 19, 2022affected < 2803.v1a_f77ffcc773fixed 2803.v1a_f77ffcc773
A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines
- CVE-2022-43402Oct 19, 2022affected < 2803.v1a_f77ffcc773fixed 2803.v1a_f77ffcc773
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the
- CVE-2022-43401Oct 19, 2022affected < 2803.v1a_f77ffcc773fixed 2803.v1a_f77ffcc773
A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the
- CVE-2022-30945May 17, 2022affected < 2692.v76bfixed 2692.v76b
Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines.
- CVE-2022-25180Feb 15, 2022affected < 2656.vf7a_e7b_75a_457fixed 2656.vf7a_e7b_75a_457
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline.
- CVE-2022-25176Feb 15, 2022affected >= 2.93, < 2.94.1fixed 2.94.1
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configure Pipelines to read a
- CVE-2022-25173Feb 15, 2022affected >= 2646.v6ed3b5b01ff1, < 2656.vf7afixed 2656.vf7a
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the control
- CVE-2020-2109Feb 12, 2020affected < 2.79fixed 2.79
Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.
- CVE-2019-1003041Mar 28, 2019affected < 2.65fixed 2.65
A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
- affected < 2.64fixed 2.64
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
- CVE-2018-1000866Dec 10, 2018affected < 2.60fixed 2.60
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Co
- affected < 2.36.1fixed 2.36.1
Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular J