Known vulnerabilities in Pipeline: Groovy

Vendor: Jenkins
Software CPE: cpe:2.3:a:jenkins:workflow-cps:*:*:*:*:*:jenkins:*:*
Total vulnerabilities: 13
Public exploits: 2
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Pipeline: Groovy Pipeline: Groovy is affected by 13 known vulnerabilities: 3 high, 7 medium, 3 low Critical High Medium Low

Vulnerabilities (13)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU135704 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVE-2026-57284
CWE-470 Medium
No
No
4331.4333.v50a_b_076c5199 29.06.2026 SB2026062911
#VU135703 - Cross-Site Request Forgery (CSRF)
CVE-2026-57283
CWE-352 Low
No
No
4331.4333.v50a_b_076c5199 29.06.2026 SB2026062911
#VU100586 - Improper input validation
CVE-2024-52550
CWE-20 Medium
No
No
3993.v3e20a_37282f8 18.11.2024 SB2024111822
#VU68596 - Protection Mechanism Failure
CVE-2022-43402
CWE-693 Medium
No
No
2803.v1a_f77ffcc773 24.10.2022 SB2022102423
SB2023020889
SB2023022307
and 4 more
#VU63358 - Security Features
CVE-2022-30945
CWE-254 Medium
No
No
2692.v76b_089ccd026 18.05.2022 SB2022051806
SB2023011328
#VU60635 - Exposure of sensitive information to an unauthorized actor
CVE-2022-25180
CWE-200 Low
No
No
2656.vf7a_e7b_75a_457 16.02.2022 SB2022021606
SB2022032826
SB2022032910
and 4 more
#VU60634 - UNIX Symbolic Link (Symlink) Following
CVE-2022-25176
CWE-61 Medium
No
No
2656.vf7a_e7b_75a_457 16.02.2022 SB2022021606
SB2022032826
SB2022032910
and 4 more
#VU60633 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2022-25173
CWE-78 Medium
No
No
2656.vf7a_e7b_75a_457 16.02.2022 SB2022021606
SB2022032826
SB2022032910
and 4 more
#VU25279 - Permissions, Privileges, and Access Controls
CVE-2020-2109
CWE-264 High
No
No
2.79 13.02.2020 SB2020021302
SB2020063006
SB2020061842
and 1 more
#VU21574 - Improper Access Control
CVE-2018-1000866
CWE-284 High
No
No
2.60 07.10.2019 SB2018121029
#VU21572 - Improper Access Control
CVE-2019-1003001
CWE-284 High
Available
No
2.61.1 07.10.2019 SB2019012212
#VU18068 - Improper Access Control
CVE-2019-1003040
CWE-284 Low
No
No
2.65 25.03.2019 SB2019032503
#VU17913 - Permissions, Privileges, and Access Controls
CVE-2019-1003030
CWE-264 Medium
Available
Exploited
2.64 07.03.2019 SB2019030709