Pipeline\ (Jenkins) - vulnerabilities (CVEs)

40 CVEs, 0 in the last 30 days, 588 known versions, newest CVE from 2026-06-24. Vendor: Jenkins.

CVEs of Pipeline\

CVE-2026-57284 - CVSS 4.3 (medium), 2026-06-24: Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator,…
CVE-2026-57283 - CVSS 4.3 (medium), 2026-06-24: A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types…
CVE-2026-48921 - CVSS 7.5 (high), 2026-05-27: Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to…
CVE-2024-52551 - CVSS 8 (high), 2024-11-13: Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a…
CVE-2024-52550 - CVSS 8 (high), 2024-11-13: Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a…
CVE-2023-32977 - CVSS 5.4 (medium), 2023-05-16: Jenkins Pipeline: Job Plugin does not escape the display name of the build that caused an earlier build to be aborted, resulting in a stored cross-site…
CVE-2023-25762 - CVSS 5.4 (medium), 2023-02-15: Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in…
CVE-2022-43407 - CVSS 8.8 (high), 2022-10-19: Jenkins Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the 'input' step, which is…
CVE-2022-43402 - CVSS 9.9 (critical), 2022-10-19: A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin…
CVE-2022-43409 - CVSS 5.4 (medium), 2022-10-19: Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in…
CVE-2022-43408 - CVSS 6.5 (medium), 2022-10-19: Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort…
CVE-2022-34177 - CVSS 7.5 (high), 2022-06-23: Jenkins Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier archives files uploaded for `file` parameters for Pipeline `input` steps on the…
CVE-2022-30945 - CVSS 8.5 (high), 2022-05-17: Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in…
CVE-2022-29047 - CVSS 5.3 (medium), 2022-04-12: Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or…
CVE-2022-28156 - CVSS 6.5 (medium), 2022-03-29: Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the…
CVE-2022-28155 - CVSS 8.1 (high), 2022-03-29: Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-28158 - CVSS 6.5 (medium), 2022-03-29: A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials…
CVE-2022-28157 - CVSS 6.5 (medium), 2022-03-29: Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins…
CVE-2022-25183 - CVSS 8.8 (high), 2022-02-15: Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any…
CVE-2022-25182 - CVSS 8.8 (high), 2022-02-15: A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure…
CVE-2022-25181 - CVSS 8.8 (high), 2022-02-15: A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure…
CVE-2022-25184 - CVSS 6.5 (medium), 2022-02-15: Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet…
CVE-2022-25174 - CVSS 8.8 (high), 2022-02-15: Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries,…
CVE-2022-25177 - CVSS 6.5 (medium), 2022-02-15: Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library…
CVE-2022-25180 - CVSS 4.3 (medium), 2022-02-15: Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers…
CVE-2022-25173 - CVSS 8.8 (high), 2022-02-15: Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file (typically…
CVE-2022-25176 - CVSS 6.5 (medium), 2022-02-15: Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM…
CVE-2022-25179 - CVSS 6.5 (medium), 2022-02-15: Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured…
CVE-2022-25175 - CVSS 8.8 (high), 2022-02-15: Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing…
CVE-2022-25178 - CVSS 6.5 (medium), 2022-02-15: Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step,…
CVE-2020-2166 - CVSS 8.8 (high), 2020-03-25: Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote…
CVE-2020-2109 - CVSS 8.8 (high), 2020-02-12: Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.
CVE-2019-10357 - CVSS 4.3 (medium), 2019-07-31: A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited…
CVE-2019-1003041 - CVSS 9.8 (critical), 2019-03-28: A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
CVE-2019-1003030 - CVSS 9.9 (critical), 2019-03-08: A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml,…
CVE-2019-1003002 - CVSS 8.8 (high), 2019-01-22: A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in…
CVE-2019-1003001 - CVSS 8.8 (high), 2019-01-22: A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java,…
CVE-2018-1000866 - CVSS 8.8 (high), 2018-12-10: A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in…
CVE-2017-1000096 - CVSS 8.8 (high), 2017-10-05: Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts…
CVE-2017-1000089 - CVSS 5.3 (medium), 2017-10-05: Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The…