org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.jenkins-ci.plugins.workflow:workflow-cps-global-lib, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (10)

• CVE-2022-43405 — CVSS 9.9 (critical): A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission…
• CVE-2022-43406 — CVSS 9.9 (critical): A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with…
• CVE-2022-25181 — CVSS 8.8 (high): A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with…
• CVE-2022-25182 — CVSS 8.8 (high): A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with…
• CVE-2022-25174 — CVSS 8.8 (high): Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for…
• CVE-2022-25183 — CVSS 8.8 (high): Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache…
• CVE-2022-25177 — CVSS 6.5 (medium): Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected…
• CVE-2022-25178 — CVSS 6.5 (medium): Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the…
• CVE-2022-29047 — CVSS 5.3 (medium): Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able to submit pull…
• CVE-2019-10357 — CVSS 4.3 (medium): A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to…