Input validation error in RadarGun - CVE-2020-2123

Vulnerability identifier: #VU25294

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-2123

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the affected software does not configure its YAML parser to prevent the instantiation of arbitrary types. A remote authenticated attacker can execute arbitrary code on the system.

RadarGun

Install updates from vendor's website.

RadarGun - update to 1.8

• http://www.openwall.com/lists/oss-security/2020/02/12/3
• https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1733

• Remote code execution in RadarGun plugin for Jenkins