Arbitrary Command Execution Affecting org.jenkins-ci.plugins:perfecto package, versions [,1.18)
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
EPSS
0.24% (62nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-728007
- published 17 Sep 2020
- disclosed 17 Sep 2020
- credit Unknown
Introduced: 17 Sep 2020
CVE-2020-2261 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.plugins:perfecto
to version 1.18 or higher.
Overview
Affected versions of this package are vulnerable to Arbitrary Command Execution. Perfecto Plugin allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations.This command is executed on the Jenkins controller in Perfecto Plugin 1.17 and earlier, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller.