Pipeline vulnerabilities
9 known vulnerabilities in Pipeline from Jenkins. 9 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Jenkins Pipeline: Groovy Libraries Plugin: Improper Link Resolution Before File Access
Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controll
- 8.0 High severity
Jenkins Pipeline: Declarative Plugin: Incorrect Default Permissions
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build
- 8.0 High severity
Jenkins Pipeline: Groovy Plugin: Improper Validation of Integrity Check Value
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whos
- 8.8 High severity
Jenkins Pipeline: Input Step Plugin: Cross-Site Request Forgery
Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is used for the URLs that process user interactions for the given 'input' step (proceed or abort) and is no
- 7.5 High severity
Jenkins Pipeline: Input Step Plugin: Improper Limitation of a Pathname to a Restricted Directory
Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the controller as part of build metadata, using the parameter name without sanitization as a relative path inside a
- 8.8 High severity
Jenkins Pipeline: Multibranch Plugin: Improper Neutralization of Special Elements used in an OS Command
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafte
- 8.8 High severity
Jenkins Pipeline: Shared Groovy Libraries Plugin: Improper Neutralization of Special Elements used in an OS Command
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller thro
- 8.8 High severity
Jenkins Pipeline: Groovy Plugin: Improper Neutralization of Special Elements used in an OS Command
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS com
- 9.9 Critical severity
Jenkins Matrix Project Plugin Remote Code Execution Exploited
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the J