Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tajljLXZqcDktcGdnaM4AAiY2

Incorrect Authorization in Puppet Enterprise Pipeline Jenkins Plugin

Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.

Permalink: https://github.com/advisories/GHSA-mj9c-vjp9-pggh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tajljLXZqcDktcGdnaM4AAiY2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 2 years ago
Updated: almost 2 years ago

CVSS Score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Percentage: 0.00105
EPSS Percentile: 0.43851

Identifiers: GHSA-mj9c-vjp9-pggh, CVE-2019-10458
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-10458
• https://jenkins.io/security/advisory/2019-10-16/#SECURITY-918
• https://github.com/advisories/GHSA-mj9c-vjp9-pggh

Blast Radius: 1.0

Affected Packages