Read the docs
TI-2022-22345 Aliases CVE-2022-45379GHSA-fv42-mx39-6fpw

Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script…

Priority LOW 33CWE-326Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-326.

Summary

Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collision attacks.

Why it matters now

EPSS 0.00509 43rd percentileScored 2026-11-07
Fix Partial Jenkins Script Security Plugin (Jenkins project): 1175.1179.vea_f7532629e1org.jenkins-ci.plugins:script-security (Maven): 1190.v65867a_a_47126Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Script Security Pluginup to 1189.vb_a_b_7c8fd5fde1175.1179.vea_f7532629e1Patch availableCNA
—org.jenkins-ci.plugins:script-security (Maven)before 1190.v65867a_a_471261190.v65867a_a_47126Patch availableGHSA-fv42-mx39-6fpw
  • Jenkins Script Security Plugin VendorJenkins Affected up to 1189.vb_a_b_7c8fd5fde Fixed in 1175.1179.vea_f7532629e1 Patch available CNA
  • org.jenkins-ci.plugins:script-security (Maven) Vendor— Affected before 1190.v65867a_a_47126 Fixed in 1190.v65867a_a_47126 Patch available GHSA-fv42-mx39-6fpw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*before 1190.v65867a_a_47126VulnerableJenkins
  • cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:* Versions before 1190.v65867a_a_47126 Vulnerable ·Jenkins

Remediation

  • Fix · CNA Jenkins Script Security Plugin (Jenkins project) Fixed in 1175.1179.vea_f7532629e1
  • Fix · GHSA-fv42-mx39-6fpw org.jenkins-ci.plugins:script-security (Maven) Fixed in 1190.v65867a_a_47126 Advisory →

Red Hat 2 advisories

  • RHSA-2023:0777 Released 2023-02-23 · Red Hat rating Critical
    OpenShift Container Platform 4.9.56 security update
    • Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins-4.9.1675668922-1.el8, jenkins-2.361.1.1675668150-1.el8
  • RHSA-2023:0560 Released 2023-02-08 · Red Hat rating Critical
    OpenShift Container Platform 4.10.51 security update
    • Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins-4.10.1675144701-1.el8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2023:0560
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2023:0777
Not affected: 2 products
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-45379
  2. 2026-10-03 Alias added: GHSA-fv42-mx39-6fpw

References

Advisory 2

Other 3

  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15845 Protection mechanism failure in Jenkins Script Security Plugin CVSS 3.1HIGH 8.8
  • TI-2024-22597 Protection mechanism failure in Jenkins Script Security Plugin CVSS 3.1CRITICAL 9.8
  • TI-2019-15850 Protection mechanism failure in Jenkins Script Security Plugin CVSS 3.1HIGH 8.8
  • TI-2019-15885 A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows… CVSS 3.1CRITICAL 9.8
  • TI-2019-07740 Code injection in Jenkins Script Security Plugin CVSS 3.1CRITICAL 9.9
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences