~ / search / GHSA-79h8-7735-v3f9

GHSA-79h8-7735-v3f9

System command execution vulnerability in Selection tasks Jenkins Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2020-2276

Packages

EcosystemPackageAffectedFixed in
Maven org.jvnet.hudson.plugins:selection-tasks-plugin <= 1.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running as.

References

External links from the advisory. They lead to third-party sites.