PT-2019-11852 · Puppet+1 · Jenkins Puppet Enterprise Pipeline+1

Jesse Glick · Publicado 2019-10-16 · Atualizado 2023-10-25 · CVE-2019-10458

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Puppet Enterprise Pipeline versions 1.3.1 and earlier

Description The issue allows attackers to execute arbitrary code if they can execute Script Security protected scripts, due to unsafe values specified in the custom Script Security whitelist.

Recommendations For Jenkins Puppet Enterprise Pipeline versions 1.3.1 and earlier, update to a version later than 1.3.1 to resolve the issue.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

CWE-183

Identificadores relacionados

CVE-2019-10458

GHSA-MJ9C-VJP9-PGGH

Produtos afetados

Jenkins

Jenkins Puppet Enterprise Pipeline

Referências · 5

• https://github.com/jenkinsci/puppet-enterprise-pipeline-plugin · Nota
• https://jenkins.io/security/advisory/2019-10-16/#SECURITY-918 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10458 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-mj9c-vjp9-pggh · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10458 · Aviso do Fabricante