Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-7ez2-n617-u3dq
Vulnerability ID VCID-7ez2-n617-u3dq
Aliases CVE-2022-30945
GHSA-2xvx-rw9p-xgfc
Summary Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Jenkins Pipeline: Groovy Plugin Pipeline: Groovy Plugin allows pipelines to load Groovy source files. This is intended to be used to allow Global Shared Libraries to execute without sandbox protection. In Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier, any Groovy source files bundled with Jenkins core and plugins could be loaded this way and their methods executed. If a suitable Groovy source file is available on the classpath of Jenkins, sandbox protections can be bypassed. The Jenkins security team has been unable to identify any Groovy source files in Jenkins core or plugins that would allow attackers to execute dangerous code. While the severity of this issue is declared as High due to the potential impact, successful exploitation is considered very unlikely. Pipeline: Groovy Plugin 2692.v76b_089ccd026 restricts which Groovy source files can be loaded in Pipelines. Groovy source files in public plugins intended to be executed in sandboxed pipelines have been identified and added to an allowlist. The new extension point `org.jenkinsci.plugins.workflow.cps.GroovySourceFileAllowlist` allows plugins to add specific Groovy source files to that allowlist if necessary, but creation of plugin-specific Pipeline DSLs is strongly discouraged.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (6)
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-552 Files or Directories Accessible to External Parties
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30945.json
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
epss 0.0111 https://api.first.org/data/v1/epss?cve=CVE-2022-30945
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-2xvx-rw9p-xgfc
cvssv3.1 7.5 https://github.com/jenkinsci/workflow-cps-plugin
generic_textual HIGH https://github.com/jenkinsci/workflow-cps-plugin
cvssv3.1 7.5 https://github.com/jenkinsci/workflow-cps-plugin/commit/76a7681702f42d65f77bbaa5463f146876ea62db
generic_textual HIGH https://github.com/jenkinsci/workflow-cps-plugin/commit/76a7681702f42d65f77bbaa5463f146876ea62db
cvssv3.1 7.5 https://github.com/jenkinsci/workflow-cps-plugin/commit/76b089ccd026b68012b0deb30c217395f7ca7dc2
generic_textual HIGH https://github.com/jenkinsci/workflow-cps-plugin/commit/76b089ccd026b68012b0deb30c217395f7ca7dc2
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-30945
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-30945
cvssv3.1 7.5 https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359
generic_textual HIGH https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359
cvssv3.1 7.5 http://www.openwall.com/lists/oss-security/2022/05/17/8
generic_textual HIGH http://www.openwall.com/lists/oss-security/2022/05/17/8
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30945.json
https://api.first.org/data/v1/epss?cve=CVE-2022-30945
https://github.com/jenkinsci/workflow-cps-plugin
https://github.com/jenkinsci/workflow-cps-plugin/commit/76a7681702f42d65f77bbaa5463f146876ea62db
https://github.com/jenkinsci/workflow-cps-plugin/commit/76b089ccd026b68012b0deb30c217395f7ca7dc2
https://nvd.nist.gov/vuln/detail/CVE-2022-30945
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359
http://www.openwall.com/lists/oss-security/2022/05/17/8
2119642 https://bugzilla.redhat.com/show_bug.cgi?id=2119642
GHSA-2xvx-rw9p-xgfc https://github.com/advisories/GHSA-2xvx-rw9p-xgfc
RHSA-2023:0017 https://access.redhat.com/errata/RHSA-2023:0017
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-30945.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/jenkinsci/workflow-cps-plugin
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/jenkinsci/workflow-cps-plugin/commit/76a7681702f42d65f77bbaa5463f146876ea62db
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/jenkinsci/workflow-cps-plugin/commit/76b089ccd026b68012b0deb30c217395f7ca7dc2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-30945
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-359
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2022/05/17/8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.78087
EPSS Score 0.0111
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:08:35.368973+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-2xvx-rw9p-xgfc/GHSA-2xvx-rw9p-xgfc.json 38.0.0