Command Injection in Convert To Pipeline - CVE-2023-28677
Published: March 22, 2023
Vulnerability identifier: #VU73937
CSH Severity: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2023-28677
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Convert To Pipeline
Convert To Pipeline
Software vendor:
Jenkins
Jenkins
Description
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to the affected plugin uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations. A remote user can execute arbitrary commands on the target system.
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.