Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1oNW12LWZ2OTgtZ3Ftcc4AAk1L

OS command injection vulnerability in Jenkins Play Framework Plugin

A form validation endpoint in Play Framework Plugin executes the play command to validate a given input file.

Play Framework Plugin 1.0.2 and earlier lets users specify the path to the play command on the Jenkins controller. This results in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins controller (e.g. through archiving artifacts).

Permalink: https://github.com/advisories/GHSA-h5mv-fv98-gqmq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oNW12LWZ2OTgtZ3Ftcc4AAk1L
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: almost 2 years ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.05077
EPSS Percentile: 0.93067

Identifiers: GHSA-h5mv-fv98-gqmq, CVE-2020-2200
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-2200
• https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1879
• http://www.openwall.com/lists/oss-security/2020/06/03/3
• https://github.com/advisories/GHSA-h5mv-fv98-gqmq

Blast Radius: 1.0

Affected Packages