Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-892e-957y-4yc8
Vulnerability ID VCID-892e-957y-4yc8
Aliases CVE-2022-45379
GHSA-fv42-mx39-6fpw
Summary Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the [SHA-1 hash](https://en.wikipedia.org/wiki/SHA-1) of the approved script. SHA-1 no longer meets the security standards for producing a cryptographically secure message digest. Script Security Plugin 1190.v65867a_a_47126 uses SHA-512 for new whole-script approvals. Previously approved scripts will have their SHA-1 based whole-script approval replaced with a corresponding SHA-512 whole-script approval when the script is next used. Whole-script approval only stores the SHA-1 or SHA-512 hash, so it is not possible to migrate all previously approved scripts automatically on startup. Administrators concerned about SHA-1 collision attacks on the whole-script approval feature are able to revoke all previous (SHA-1) script approvals on the In-Process Script Approval page.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-326 Inadequate Encryption Strength
CWE-328 Use of Weak Hash
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.0 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-45379.json
epss 0.0032 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
epss 0.0032 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
epss 0.0032 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
epss 0.0032 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
epss 0.0032 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
epss 0.0032 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
epss 0.0032 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
epss 0.0032 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
epss 0.0034 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
epss 0.0034 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
epss 0.00362 https://api.first.org/data/v1/epss?cve=CVE-2022-45379
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-fv42-mx39-6fpw
cvssv3.1 8.0 https://github.com/jenkinsci/script-security-plugin
generic_textual HIGH https://github.com/jenkinsci/script-security-plugin
cvssv3.1 8.0 https://github.com/jenkinsci/script-security-plugin/commit/65867aa471265a16198b92fb439782ba3554da66
generic_textual HIGH https://github.com/jenkinsci/script-security-plugin/commit/65867aa471265a16198b92fb439782ba3554da66
cvssv3.1 8.0 https://nvd.nist.gov/vuln/detail/CVE-2022-45379
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-45379
cvssv3.1 8.0 https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2564
generic_textual HIGH https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2564
cvssv3.1 8.0 http://www.openwall.com/lists/oss-security/2022/11/15/4
generic_textual HIGH http://www.openwall.com/lists/oss-security/2022/11/15/4
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-45379.json
https://api.first.org/data/v1/epss?cve=CVE-2022-45379
https://github.com/jenkinsci/script-security-plugin
https://github.com/jenkinsci/script-security-plugin/commit/65867aa471265a16198b92fb439782ba3554da66
https://nvd.nist.gov/vuln/detail/CVE-2022-45379
https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2564
http://www.openwall.com/lists/oss-security/2022/11/15/4
2143090 https://bugzilla.redhat.com/show_bug.cgi?id=2143090
GHSA-fv42-mx39-6fpw https://github.com/advisories/GHSA-fv42-mx39-6fpw
RHSA-2023:0560 https://access.redhat.com/errata/RHSA-2023:0560
RHSA-2023:0777 https://access.redhat.com/errata/RHSA-2023:0777
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-45379.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/jenkinsci/script-security-plugin
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/jenkinsci/script-security-plugin/commit/65867aa471265a16198b92fb439782ba3554da66
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-45379
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2564
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2022/11/15/4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.55036
EPSS Score 0.0032
Published At April 7, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:07:14.751752+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/11/GHSA-fv42-mx39-6fpw/GHSA-fv42-mx39-6fpw.json 38.0.0