What is GHSA-p5x5-jg3j-2jcj?

GHSA-p5x5-jg3j-2jcj is a security advisory published by GitHub Security Advisories with High severity. OS command injection in CryptoMove Plugin

Which CVE IDs does GHSA-p5x5-jg3j-2jcj cover?

GHSA-p5x5-jg3j-2jcj covers the following CVE IDs: CVE-2020-2159. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p5x5-jg3j-2jcj?

GHSA-p5x5-jg3j-2jcj has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-p5x5-jg3j-2jcj?

GHSA-p5x5-jg3j-2jcj affects 1 product, including: maven/io.jenkins.plugins:cryptomove:\u003c= 0.1.33.

GHSA-p5x5-jg3j-2jcjHighCVSS 8.8

OS command injection in CryptoMove Plugin

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 29, 2023

🔗 CVE IDs covered (1)

CVE-2020-2159 →

📋 Description

CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS command on the Jenkins controller.

🎯 Affected products1

maven/io.jenkins.plugins:cryptomove:<= 0.1.33

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-2159
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1635
http://www.openwall.com/lists/oss-security/2020/03/09/1
https://github.com/advisories/GHSA-p5x5-jg3j-2jcj