Description

Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

Remediation

References

https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-1737

Related Vulnerabilities

CVE-2022-45400 Vulnerability in maven package org.jvnet.hudson.plugins:japex

CVE-2012-0394 Vulnerability in maven package org.apache.struts.xwork:xwork-core

CVE-2018-20677 Vulnerability in maven package org.webjars.bowergithub.twbs:bootstrap-sass

CVE-2018-19837 Vulnerability in npm package node-sass

CVE-2023-25164 Vulnerability in npm package @tinacms/cli

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory NVD-CWE-noinfo