GitHub Advisoryadvisory · Maven

GHSA-c329-r874-xc7j Remote Code Execution vulnerability in Jenkins Literate Plugin

HIGH Published 2022-05-24 Modified 2023-01-05 Official page ↗
Aliases
CVE-2020-2158
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:literate
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-01-05

Affected packages

• Maven org.jenkins-ci.plugins:literate: <= 1.0 (no fix yet)

Description

Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

Related

Alias · CVE (1)

  • CVE-2020-2158 Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References