Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
[
{
"product": "Jenkins Pipeline: Shared Groovy Libraries Plugin",
"vendor": "Jenkins project",
"versions": [
{
"lessThanOrEqual": "552.vd9cc05b8a2e1",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2.21.1"
},
{
"status": "unaffected",
"version": "2.18.1"
}
]
}
]