GitHub Advisoryadvisory · Maven

GHSA-p5x5-jg3j-2jcj OS command injection in CryptoMove Plugin

HIGH Published 2022-05-24 Modified 2023-01-05 Official page ↗
Aliases
CVE-2020-2159
Ecosystem
Maven
Packages
io.jenkins.plugins:cryptomove
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2023-01-05

Affected packages

• Maven io.jenkins.plugins:cryptomove: <= 0.1.33 (no fix yet)

Description

CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS command on the Jenkins controller.

Related

Alias · CVE (1)

  • CVE-2020-2159 Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References