Remote Code Execution (RCE)

🗓️ 22 Aug 2023 11:14:09Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 25 Views

org.jenkins-ci.plugins: convert-to-pipeline is vulnerable to Remote Code Execution (RCE). The vulnerability exists due to improperly converting the build environment, build steps, and post-build actions of freestyle projects to the corresponding pipeline step invocations via simple string concatenation, which allows an attacker to upload and execute malicious code onto the system

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the Freestyle Project Configuration Handler component of the Convert To Pipeline Plugin allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.	10 Apr 202300:00	–	bdu_fstec
Tenable Nessus	Jenkins Enterprise and Operations Center 2.346.x < 2.346.40.0.12 Multiple Vulnerabilities (CloudBees Security Advisory 2023-03-21-security-advisory)	21 Mar 202300:00	–	nessus
Tenable Nessus	Jenkins plugins Multiple Vulnerabilities (2023-03-21)	31 Jul 202300:00	–	nessus
CNNVD	Jenkins Plugins Convert To Pipeline 命令注入漏洞	23 Mar 202300:00	–	cnnvd
CVE	CVE-2023-28677	23 Mar 202311:26	–	cve
Cvelist	CVE-2023-28677	23 Mar 202311:26	–	cvelist
EUVD	EUVD-2023-1224	3 Oct 202520:07	–	euvd
Github Security Blog	Jenkins Convert To Pipeline Plugin vulnerable to command injection	2 Apr 202321:30	–	github
NVD	CVE-2023-28677	2 Apr 202321:15	–	nvd
OSV	CVE-2023-28677	2 Apr 202321:15	–	osv