Incorrect Authorization in Puppet Enterprise Pipeline Jenkins Plugin

2022-05-2416:58:51

Google

osv.dev

0.001 Low

EPSS

Percentile

43.3%

JSON

Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.

CPENameOperatorVersion
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipelineeq1.2.2
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipelineeq1.1.0
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipelineeq1.3.1
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipelineeq1.0.1
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipelineeq1.3.0
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipelineeq1.2.1
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipelineeq1.2.3
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipelineeq1.1.1

Name	Operator	Version
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline	eq	1.2.2
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline	eq	1.1.0
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline	eq	1.3.1
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline	eq	1.0.1
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline	eq	1.3.0
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline	eq	1.2.1
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline	eq	1.2.3
org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline	eq	1.1.1