GHSA-p5x5-jg3j-2jcj

Source

https://github.com/advisories/GHSA-p5x5-jg3j-2jcj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p5x5-jg3j-2jcj/GHSA-p5x5-jg3j-2jcj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p5x5-jg3j-2jcj

Aliases

CVE-2020-2159

Published

2022-05-24T17:10:30Z

Modified

2023-11-08T04:02:53.920632Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

OS command injection in CryptoMove Plugin

Details

CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS command on the Jenkins controller.

Database specific

{
    "nvd_published_at": "2020-03-09T16:15:00Z",
    "github_reviewed_at": "2023-01-05T21:09:57Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-78"
    ]
}

References

Affected packages

Maven / io.jenkins.plugins:cryptomove

Package

Name: io.jenkins.plugins:cryptomove; View open source insights on deps.dev
Purl: pkg:maven/io.jenkins.plugins/cryptomove

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.1.33

Affected versions

0.*

0.1.17

0.1.19

0.1.20

0.1.21

0.1.22

0.1.23

0.1.24

0.1.25

0.1.26

0.1.27

0.1.28

0.1.29

0.1.30

0.1.31

0.1.32

0.1.33