Jenkins Pipeline: Groovy Plugin vulnerabilities

3 known vulnerabilities in Jenkins Pipeline: Groovy Plugin from Jenkins. 3 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.0 High severity

  Jenkins Pipeline: Groovy Plugin: Improper Validation of Integrity Check Value

  CVE-2024-52550Nov 13, 2024Jenkins

  Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whos

• 8.8 High severity

  Jenkins Pipeline: Groovy Plugin: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-25173Feb 15, 2022JenkinsEPSS 1.44%

  Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS com

• 9.9 Critical severity

  Jenkins Matrix Project Plugin Remote Code Execution Exploited

  CVE-2019-1003030Mar 8, 2019JenkinsEPSS 97.1%

  A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the J