CVE-2022-23118 : faille élevée Jenkins project Jenkins Debian Package… (CVSS 8.8)

Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path on the controller, allowing attackers able to control agent processes to invoke arbitrary OS commands on the controller.

Sévérité

Élevée (CVSS 8.8)

Vecteur CVSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation active

Non signalée par la CISA

Publication

12 janv. 2022

Dernière mise à jour

19 nov. 2024

• Jenkins project Jenkins Debian Package Builder Plugin

• Fiche CVE-2022-23118 sur le NVD (NIST)
• jenkins.io/security/advisory/2022-01-12/
• openwall.com/lists/oss-security/2022/01/12/6