Improper Neutralization of Special Elements used in an OS Command in Jenkins Pipeline: Shared Groovy Libraries Plugin

2022-02-1600:01:36

Google

osv.dev

0.001 Low

EPSS

Percentile

46.1%

JSON

Jenkins Pipeline: Shared Groovy Libraries Plugin prior to 561.va_ce0de3c2d69, 2.21.1, and 2.18.1 uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

CPENameOperatorVersion
org.jenkins-ci.plugins.workflow:workflow-cps-global-libeq1.3
org.jenkins-ci.plugins.workflow:workflow-cps-global-libeq0.1-beta-5
org.jenkins-ci.plugins.workflow:workflow-cps-global-libeq0.1-beta-7
org.jenkins-ci.plugins.workflow:workflow-cps-global-libeq1.14
org.jenkins-ci.plugins.workflow:workflow-cps-global-libeq2.20
org.jenkins-ci.plugins.workflow:workflow-cps-global-libeq1.4.3-beta-1
org.jenkins-ci.plugins.workflow:workflow-cps-global-libeq1.4.3
org.jenkins-ci.plugins.workflow:workflow-cps-global-libeq2.7
org.jenkins-ci.plugins.workflow:workflow-cps-global-libeq2.6
org.jenkins-ci.plugins.workflow:workflow-cps-global-libeq0.1-beta-6

Name	Operator	Version
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	eq	1.3
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	eq	0.1-beta-5
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	eq	0.1-beta-7
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	eq	1.14
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	eq	2.20
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	eq	1.4.3-beta-1
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	eq	1.4.3
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	eq	2.7
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	eq	2.6
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib	eq	0.1-beta-6