Description

Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller

Remediation

References

https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1980

http://www.openwall.com/lists/oss-security/2020/09/16/3

Related Vulnerabilities

CVE-2021-43309 Vulnerability in npm package uri-template-lite

CVE-2023-38507 Vulnerability in npm package @strapi/plugin-users-permissions

CVE-2022-45688 Vulnerability in maven package cn.hutool:hutool-json

CVE-2022-25858 Vulnerability in maven package org.webjars.npm:terser

CVE-2021-41174 Vulnerability in npm package @grafana/data

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Third Party Advisory