SB2022011409 - OS Command Injection in Jenkins Debian Package Builder plugin
Published: January 14, 2022
Security Bulletin ID
SB2022011409
Severity
Medium
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) OS Command Injection (CVE-ID: CVE-2022-23118)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to the affected plugin implements functionality that allows agent processes to invoke command-line git at an attacker-specified path on the controller. A remote authenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.