CVE-2022-25182: 
Java vulnerability analysis and mitigation

A sandbox bypass vulnerability (CVE-2022-25182) was discovered in Jenkins Pipeline: Shared Groovy Libraries Plugin version 552.vd9cc05b8a2e1 and earlier. The vulnerability was disclosed on February 15, 2022, affecting the Jenkins Pipeline plugin system. The issue stems from the plugin using library names to create directories without proper canonicalization or sanitization (Jenkins Advisory).

The vulnerability exists because the Pipeline: Deprecated Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier versions use Pipeline library names to create directories without implementing proper canonicalization or sanitization measures. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

This vulnerability allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. The attack is possible when a global Pipeline library is already configured in the system (Jenkins Advisory).

The vulnerability has been fixed in Pipeline: Deprecated Groovy Libraries Plugin version 561.va_ce0de3c2d69, which implements proper sanitization of Pipeline library names when creating library directories. Users are advised to upgrade to this version or later to address the security issue (Jenkins Advisory).