CVE-2022-23118

HIGH7.5EPSS 1.1%

Agent-to-controller security bypass in Jenkins Debian Package Builder Plugin

Published: 1/13/2022Modified: 2/16/2024

Description

Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agent processes to invoke command-line git at an attacker-specified path on the controller. This allows attackers able to control agent processes to invoke arbitrary OS commands on the controller.

Affected packages (1)

Maven/ru.yandex.jenkins.plugins.debuilder:debian-package-builderfrom 0, <= 1.6.11

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-23118
PATCHhttps://github.com/jenkinsci/debian-package-builder-plugin
WEBhttps://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2546
WEBhttp://www.openwall.com/lists/oss-security/2022/01/12/6