CVE-2022-25175

HIGH

Jenkins Pipeline < 706.vd43c65dec013 - OS Command Injection

Title source: rule

Description

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

Exploits (1)

nomisec WRITEUP
by shoucheng3 · poc
https://github.com/shoucheng3/jenkinsci__workflow-multibranch-plugin_CVE-2022-25175_706-vd43c65dec013

References (1)

Scores

CVSS v3 8.8
EPSS 0.0042
EPSS Percentile 62.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
jenkins/pipeline\ < 706.vd43c65dec013
org.jenkins-ci.plugins.workflow/workflow-multibranch 0 - 707.v71c3f0a_6ccdbMaven
Published Feb 15, 2022
Tracked Since Feb 18, 2026