Command injection

2020-06-0313:15:00

PRIOn knowledge base

www.prio-n.com

8.9 High

AI Score

Confidence

High

0.051 Low

EPSS

Percentile

93.0%

JSON

Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the play command on the Jenkins master for a form validation endpoint, resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master.

CPENameOperatorVersion
play_frameworkle1.0.2

CPE	Name	Operator	Version
	play_framework	le	1.0.2

References

www.openwall.com/lists/oss-security/2020/06/03/3

jenkins.io/security/advisory/2020-06-03/