GitHub Advisoryadvisory · Maven

GHSA-p6qc-37hq-wqr6 Remote code execution vulnerability in Jenkins Templating Engine Plugin

HIGH Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2021-21646
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:templating-engine
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-693
Reviewed
2022-12-13

Affected packages

• Maven org.jenkins-ci.plugins:templating-engine: < 2.2 → fixed in 2.2

Description

Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin. This vulnerability allows attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. Jenkins Templating Engine Plugin 2.2 integrates with Script Security Plugin to protect its pipeline configurations.

Related

Alias · CVE (1)

  • CVE-2021-21646 Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing… vulnerability

Weakness · CWE (1)

  • CWE-693 Protection Mechanism Failure weakness

References