Main Vulnerability Database SB2020021314

SB2020021314 - Remote code execution in RadarGun plugin for Jenkins

Published: February 13, 2020

Security Bulletin ID SB2020021314

Severity

High

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Input validation error (CVE-ID: CVE-2020-2123)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the affected software does not configure its YAML parser to prevent the instantiation of arbitrary types. A remote authenticated attacker can execute arbitrary code on the system.

Remediation

Install update from vendor's website.

References

http://www.openwall.com/lists/oss-security/2020/02/12/3
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1733