GHSA-x3jj-rgw9-7r5g
RCE vulnerability in Jenkins DotCi Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.groupon.jenkins-ci.plugins:DotCi | <= 2.40.00 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types.
This results in a remote code execution (RCE) vulnerability exploitable by attackers able to modify `.ci.yml` files in SCM. This plugin has been suspended.
References
External links from the advisory. They lead to third-party sites.