GHSA-h5mv-fv98-gqmq
OS command injection vulnerability in Jenkins Play Framework Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:play-autotest-plugin | <= 1.0.2 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
A form validation endpoint in Play Framework Plugin executes the `play` command to validate a given input file.
Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins controller. This results in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins controller (e.g. through archiving artifacts).
References
External links from the advisory. They lead to third-party sites.