What is GHSA-jq84-6fmm-6qv6?

GHSA-jq84-6fmm-6qv6 is a security advisory published by GitHub Security Advisories with High severity. OS command execution vulnerability in Perfecto Plugin

Which CVE IDs does GHSA-jq84-6fmm-6qv6 cover?

GHSA-jq84-6fmm-6qv6 covers the following CVE IDs: CVE-2020-2261. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jq84-6fmm-6qv6?

GHSA-jq84-6fmm-6qv6 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-jq84-6fmm-6qv6?

GHSA-jq84-6fmm-6qv6 affects 1 product, including: maven/io.jenkins.plugins:perfecto:\u003c= 1.17.

GHSA-jq84-6fmm-6qv6HighCVSS 8.8

OS command execution vulnerability in Perfecto Plugin

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 28, 2023

🔗 CVE IDs covered (1)

CVE-2020-2261 →

📋 Description

Perfecto Plugin allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations.

This command is executed on the Jenkins controller in Perfecto Plugin 1.17 and earlier, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller.

Perfecto Plugin 1.18 executes the specified commands on the agent the build is running on.

🎯 Affected products1

maven/io.jenkins.plugins:perfecto:<= 1.17

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-2261
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1980
http://www.openwall.com/lists/oss-security/2020/09/16/3
https://github.com/advisories/GHSA-jq84-6fmm-6qv6