MEDIUM 6.5 Maven
Improper Link Resolution Before File Access in Jenkins Pipeline: Groovy Plugin
GHSA-6473-gqrj-4p65 · CVE-2022-25176
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.
Ready to move
Start Securing
Free, no credit card | First findings in minutes