Arbitrary Code Execution Affecting org.jenkins-ci.plugins.workflow:workflow-cps package, versions [,2692.v76b_089ccd026)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.09% (41st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Arbitrary Code Execution vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JAVA-ORGJENKINSCIPLUGINSWORKFLOW-3153485
  • published4 Dec 2022
  • disclosed18 May 2022
  • creditUnknown

Introduced: 18 May 2022

CVE-2022-30945  (opens in a new tab)
CWE-434  (opens in a new tab)
CWE-552  (opens in a new tab)

How to fix?

Upgrade org.jenkins-ci.plugins.workflow:workflow-cps to version 2692.v76b_089ccd026 or higher.

Overview

org.jenkins-ci.plugins.workflow:workflow-cps is a Jenkins Plugins Parent POM Project.

Affected versions of this package are vulnerable to Arbitrary Code Execution via a possible Sandbox Bypass through implicitly allowlisted platform Groovy files.

Note: The Jenkins security team has been unable to identify any Groovy source files in Jenkins core or plugins that would allow attackers to execute dangerous code. While the severity of this issue is declared as High due to the potential impact, successful exploitation is considered very unlikely.

CVSS Scores

version 3.1