GitHub Advisoryadvisory · Maven

GHSA-h5mv-fv98-gqmq OS command injection vulnerability in Jenkins Play Framework Plugin

HIGH Published 2022-05-24 Modified 2022-12-21 Official page ↗
Aliases
CVE-2020-2200
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:play-autotest-plugin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2022-12-21

Affected packages

• Maven org.jenkins-ci.plugins:play-autotest-plugin: <= 1.0.2 (no fix yet)

Description

A form validation endpoint in Play Framework Plugin executes the `play` command to validate a given input file. Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins controller. This results in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins controller (e.g. through archiving artifacts).

Related

Alias · CVE (1)

  • CVE-2020-2200 Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References