VulnerableCode Package Details - pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps-global-lib@544.vff04fa68714d

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps-global-lib@544.vff04fa68714d

Essentials
History (3)

purl	pkg:maven/org.jenkins-ci.plugins.workflow/workflow-cps-global-lib@544.vff04fa68714d

Next non-vulnerable version	561.va
Latest non-vulnerable version	588.v576c103a_ff86
Risk	4.0

Vulnerabilities affecting this package (2)

Vulnerability	Summary	Fixed by
VCID-a8d9-5365-qubn Aliases: CVE-2022-25174 GHSA-g9fx-6j5c-grmw	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.	561.va Affected by 0 other vulnerabilities. 561.va_ce0de3c2d69 Affected by 0 other vulnerabilities.
VCID-k6wy-rwhv-ckd2 Aliases: CVE-2022-29047 GHSA-hh6f-6fp5-gfpv	Incorrect Authorization Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.	566.vd0a Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-a8d9-5365-qubn
Aliases:
CVE-2022-25174
GHSA-g9fx-6j5c-grmw

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

561.va
Affected by 0 other vulnerabilities.

561.va_ce0de3c2d69
Affected by 0 other vulnerabilities.

VCID-k6wy-rwhv-ckd2
Aliases:
CVE-2022-29047
GHSA-hh6f-6fp5-gfpv

Incorrect Authorization Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the definition of a dynamically retrieved library in their pull request, even if the Pipeline is configured to not trust them.

566.vd0a
Affected by 0 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T16:00:17.801699+00:00	GHSA Importer	Affected by	VCID-k6wy-rwhv-ckd2	https://github.com/advisories/GHSA-hh6f-6fp5-gfpv	38.0.0
2026-04-01T15:59:56.399728+00:00	GHSA Importer	Affected by	VCID-a8d9-5365-qubn	https://github.com/advisories/GHSA-g9fx-6j5c-grmw	38.0.0
2026-04-01T12:49:49.799555+00:00	GitLab Importer	Affected by	VCID-k6wy-rwhv-ckd2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.jenkins-ci.plugins.workflow/workflow-cps-global-lib/CVE-2022-29047.yml	38.0.0