PT-2020-15486 · Jenkins · Jenkins Perfecto Plugin+1

Published 2020-09-16 · Updated 2023-10-25 · CVE-2020-2261

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Perfecto Plugin versions 1.17 and earlier

Description The issue allows attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller. This is possible because the Perfecto Plugin executes a command on the Jenkins controller. The plugin allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations, which is then executed on the Jenkins controller in versions 1.17 and earlier.

Recommendations For Jenkins Perfecto Plugin versions 1.17 and earlier, update to version 1.18 or later, which executes the specified commands on the agent the build is running on, mitigating the risk of arbitrary command execution on the Jenkins controller.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-2261

GHSA-JQ84-6FMM-6QV6

Affected Products

Jenkins

Jenkins Perfecto Plugin

References · 6

• https://jenkins.io/security/advisory/2020-09-16/#SECURITY-1980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2261 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2261 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jq84-6fmm-6qv6 · Vendor Advisory
• https://github.com/jenkinsci/perfecto-plugin · Note
• http://openwall.com/lists/oss-security/2020/09/16/3 · Note