PT-2020-15414 · Jenkins · Jenkins Play Framework Plugin+1

Daniel Beck · Published 2020-06-03 · Updated 2023-10-25 · CVE-2020-2200

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Play Framework Plugin versions 1.0.2 and earlier

Description The issue concerns an OS command injection vulnerability. It occurs because a form validation endpoint in the Play Framework Plugin executes the play command to validate a given input file, and users can specify the path to this command on the Jenkins master. This vulnerability is exploitable by users who can store a file on the Jenkins master, such as through archiving artifacts.

Recommendations For Jenkins Play Framework Plugin versions 1.0.2 and earlier, consider restricting access to the form validation endpoint to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the endpoint that executes the play command for file validation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-2200

GHSA-H5MV-FV98-GQMQ

Affected Products

Jenkins

Jenkins Play Framework Plugin

References · 6

• https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2200 · Security Note
• https://osv.dev/vulnerability/GHSA-h5mv-fv98-gqmq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2200 · Vendor Advisory
• https://github.com/jenkinsci/play-plugin · Note
• http://openwall.com/lists/oss-security/2020/06/03/3 · Note