CVE-2023-28677

2023-03-2311:26:06

jenkins

www.cve.org

cve-2023-28677

jenkins

pipeline

plugin

freestyle projects

build environment

build steps

post-build actions

configuration

injection

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.0%

JSON

Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects’ Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a convertion by Jenkins Convert To Pipeline Plugin.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "Jenkins Convert To Pipeline Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "1.0",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]