OS Command Injection

2022-04-2100:42:14

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

40.9%

JSON

jenkins-2-plugins is vulnerable to OS command injection. The vulnerability exists due to a lack of sanitization for distinct SCMs for the readTrusted step allowing an attacker with item/configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.

CPENameOperatorVersion
jenkins-2-pluginseq4.6.1629443573__1.el8
jenkins-2-pluginseq4.6.1643965689__1.el8
jenkins-2-pluginseq4.7.1616671397__1.el8
jenkins-2-pluginseq4.9.1642418992__1.el8
jenkins-2-pluginseq4.7.1643883495__1.el8
jenkins-2-pluginseq4.6.1623162648__1.el8
jenkins-2-pluginseq4.9.1641470084__1.el8
jenkins-2-pluginseq4.8.1641573626__1.el8
jenkins-2-pluginseq4.8.1642609156__1.el8
jenkins-2-pluginseq4.9.1643389956__1.el8

Name	Operator	Version
jenkins-2-plugins	eq	4.6.1629443573__1.el8
jenkins-2-plugins	eq	4.6.1643965689__1.el8
jenkins-2-plugins	eq	4.7.1616671397__1.el8
jenkins-2-plugins	eq	4.9.1642418992__1.el8
jenkins-2-plugins	eq	4.7.1643883495__1.el8
jenkins-2-plugins	eq	4.6.1623162648__1.el8
jenkins-2-plugins	eq	4.9.1641470084__1.el8
jenkins-2-plugins	eq	4.8.1641573626__1.el8
jenkins-2-plugins	eq	4.8.1642609156__1.el8
jenkins-2-plugins	eq	4.9.1643389956__1.el8