CVE-2020-2166

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-2166
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-2166.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-2166
Aliases
Published
2020-03-25T17:15:15.467Z
Modified
2026-07-09T00:13:34.468209Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

References

Affected packages

Git / github.com/jenkinsci/pipeline-aws-plugin

Affected ranges

Type
GIT
Repo
https://github.com/jenkinsci/pipeline-aws-plugin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
bf4c6bfcc65628d5ce0f8e9f545193907b4861b9
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:jenkins:pipeline\\:_aws_steps:*:*:*:*:*:jenkins:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.40"
        }
    ]
}

Affected versions

pipeline-aws-1.*
pipeline-aws-1.0
pipeline-aws-1.1
pipeline-aws-1.10
pipeline-aws-1.11
pipeline-aws-1.12
pipeline-aws-1.13
pipeline-aws-1.14
pipeline-aws-1.15
pipeline-aws-1.16
pipeline-aws-1.17
pipeline-aws-1.18
pipeline-aws-1.19
pipeline-aws-1.2
pipeline-aws-1.20
pipeline-aws-1.21
pipeline-aws-1.22
pipeline-aws-1.23
pipeline-aws-1.24
pipeline-aws-1.25
pipeline-aws-1.26
pipeline-aws-1.27
pipeline-aws-1.28
pipeline-aws-1.29
pipeline-aws-1.3
pipeline-aws-1.30
pipeline-aws-1.31
pipeline-aws-1.32
pipeline-aws-1.33
pipeline-aws-1.34
pipeline-aws-1.35
pipeline-aws-1.36
pipeline-aws-1.37
pipeline-aws-1.38
pipeline-aws-1.39
pipeline-aws-1.4
pipeline-aws-1.40
pipeline-aws-1.5
pipeline-aws-1.6
pipeline-aws-1.7
pipeline-aws-1.8
pipeline-aws-1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-2166.json"