~ / search / GHSA-mj9c-vjp9-pggh

GHSA-mj9c-vjp9-pggh

Incorrect Authorization in Puppet Enterprise Pipeline Jenkins Plugin

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10458

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline <= 1.3.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.

References

External links from the advisory. They lead to third-party sites.