TI-2022-11613 Aliases CVE-2022-29047 GHSA-hh6f-6fp5-gfpv

Incorrect authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin

LOW 32CWE-863Published 2022-04-12 · Updated 2024-11-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01184 67th percentileScored 2026-11-07

Fix Fixed Jenkins Pipeline: Shared Groovy Libraries Plugin (Jenkins project): 2.21.3org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (Maven): 2.21.3, 566.vd0aRed Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins Pipeline: Shared Groovy Libraries Plugin	up to 564.ve62a_4eb_b_e039	2.21.3	Patch available	CNA
—	org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (Maven)	before 2.21.3	2.21.3	Patch available	GHSA-hh6f-6fp5-gfpv
—	org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (Maven)	544.vff04fa68714d to before 566.vd0a	566.vd0a	Patch available	GHSA-hh6f-6fp5-gfpv

Jenkins Pipeline: Shared Groovy Libraries Plugin VendorJenkins Affected up to 564.ve62a_4eb_b_e039 Fixed in 2.21.3 Patch available CNA
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (Maven) Vendor— Affected before 2.21.3 Fixed in 2.21.3 Patch available GHSA-hh6f-6fp5-gfpv
org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (Maven) Vendor— Affected 544.vff04fa68714d to before 566.vd0a Fixed in 566.vd0a Patch available GHSA-hh6f-6fp5-gfpv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:pipeline\:_shared_groovy_libraries::::::jenkins::*	_shared_groovy_libraries	Vulnerable	Jenkins

cpe:2.3:a:jenkins:pipeline\:_shared_groovy_libraries:*:*:*:*:*:jenkins:*:* Versions _shared_groovy_libraries Vulnerable ·Jenkins

Remediation

Fix · CNA Jenkins Pipeline: Shared Groovy Libraries Plugin (Jenkins project) Fixed in 2.21.3
Fix · GHSA-hh6f-6fp5-gfpv org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (Maven) Fixed in 2.21.3 Advisory →
Fix · GHSA-hh6f-6fp5-gfpv org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (Maven) Fixed in 566.vd0a Advisory →

Red Hat 4 advisories

RHSA-2023:1064 Released 2023-03-06 · Red Hat rating Critical
OpenShift Developer Tools and Services for OCP 4.12 security update
- OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1675702407-1.el8
RHSA-2023:0017 Released 2023-01-12 · Red Hat rating Important
OpenShift Container Platform 4.8.56 packages and security update
- Red Hat OpenShift Container Platform 4.8 jenkins-2-plugins-4.8.1672842762-1.el8, jenkins-2.361.1.1672840472-1.el8
RHSA-2022:4909 Released 2022-06-10 · Red Hat rating Important
OpenShift Container Platform 4.7.52 paackages and security update
- Red Hat OpenShift Container Platform 4.7 jenkins-2-plugins-4.7.1652967082-1.el8

Show 1 more Red Hat advisories

RHSA-2022:2205 Released 2022-05-18 · Red Hat rating Important
OpenShift Container Platform 4.9.33 packages and security update
- Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins-4.9.1651754460-1.el8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Developer Tools and Services for OCP 4.12	Fixed	RHSA-2023:1064
Red Hat OpenShift Container Platform 4.7	Fixed	RHSA-2022:4909
Red Hat OpenShift Container Platform 4.8	Fixed	RHSA-2023:0017
Red Hat OpenShift Container Platform 4.9	Fixed	RHSA-2022:2205

Not affected: 5 products

OpenShift Developer Tools and Services for OCP 4.12
Red Hat OpenShift Container Platform 3.11
Red Hat OpenShift Container Platform 4.7
Red Hat OpenShift Container Platform 4.8
Red Hat OpenShift Container Platform 4.9

Timeline

2026-10-02 Threatist record created from CVE-2022-29047
2026-10-03 Alias added: GHSA-hh6f-6fp5-gfpv

References

Advisory 2

Other 2

TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2019-15846 A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in… CVSS 3.1HIGH 8.8
TI-2019-15847 A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier… CVSS 3.1HIGH 8.8
TI-2023-11034 Cross-site scripting in Jenkins Pipeline: Build Step Plugin CVSS 3.1MEDIUM 5.4
TI-2019-15886 A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows… CVSS 3.1CRITICAL 9.8
TI-2022-21197 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin CVSS 3.1CRITICAL 9.9

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences