Rapid7 Vulnerability & Exploit Database

Red Hat OpenShift: CVE-2022-29047: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin

Free InsightVM Trial No credit card necessary
Watch Demo See how it all works
Back to Search

Red Hat OpenShift: CVE-2022-29047: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin

Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
Published
04/12/2022
Created
05/20/2022
Added
05/19/2022
Modified
07/04/2023

Description

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.

Solution(s)

  • linuxrpm-upgrade-jenkins-2-plugins

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;