GHSA-p5x5-jg3j-2jcj
OS command injection in CryptoMove Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.jenkins.plugins:cryptomove | <= 0.1.33 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS command on the Jenkins controller.
References
External links from the advisory. They lead to third-party sites.