CVE-2022-29047: 
Java vulnerability analysis and mitigation

CVE-2022-29047 is a high-severity vulnerability affecting the Jenkins Pipeline: Shared Groovy Libraries Plugin versions 564.ve62a4ebb_e039 and earlier, except 2.21.3. The vulnerability was discovered and disclosed on April 12, 2022, impacting the security controls of Jenkins Multibranch Pipelines (Jenkins Advisory).

The vulnerability exists in the Pipeline: Deprecated Groovy Libraries Plugin where the protection mechanisms that limit Pipeline definition changes do not apply to the library step with a retriever argument pointing to a library in the current build's repository and branch. This specifically affects scenarios using library configuration with retriever: legacySCM(scm) (Jenkins Advisory).

The vulnerability allows attackers with pull request (or equivalent) access, but without direct commit permissions to the configured SCM, to modify Pipeline behavior by changing library behavior in their pull request, even when the Pipeline is configured to not trust them (Jenkins Advisory).

The vulnerability has been fixed in Pipeline: Deprecated Groovy Libraries Plugin versions 566.vd0aa3334a_555 and 2.21.3. The fix aborts library retrieval if the library would be retrieved from the same repository and revision as the current build, and the revision being built is untrusted (Jenkins Advisory).