CVE-2022-30945: High severity jenkins pipeline vulnerability
Jenkins Pipeline: Groovy Plugin 2689.v434009a31bf1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines.
Other sources
A flaw was found in Jenkins Groovy Plugin. The plugin allows pipelines to load Groovy source files. The intent is to allow Global Shared Libraries to execute without sandbox protection. The issue is that the plugin allows any Groovy source files bundled with Jenkins core and plugins to be loaded this way and their methods executed. If a suitable Groovy source file is available on the classpath of Jenkins, sandbox protections can be bypassed. No Groovy source files were found in Jenkins core or plugins that could result in attackers executing dangerous code; hence successful exploitation is considered highly unlikely.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-30945?
CVE-2022-30945 is classified as a high severity vulnerability due to its potential impact on Jenkins installations.
How do I fix CVE-2022-30945?
To fix CVE-2022-30945, upgrade the Jenkins Pipeline: Groovy Plugin to version 2689.v434009a_31b_f2 or later.
What impact does CVE-2022-30945 have on Jenkins security?
CVE-2022-30945 allows unauthorized loading of Groovy source files in sandboxed pipelines, potentially leading to code execution risk.
Which versions of Jenkins are affected by CVE-2022-30945?
CVE-2022-30945 affects Jenkins Pipeline: Groovy Plugin versions 2689.v434009a_31b_f1 and earlier.
Can CVE-2022-30945 lead to remote code execution?
Yes, CVE-2022-30945 can potentially lead to remote code execution through the exploitation of Groovy scripts in Jenkins.