GHSA-p6qc-37hq-wqr6

Source

https://github.com/advisories/GHSA-p6qc-37hq-wqr6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p6qc-37hq-wqr6/GHSA-p6qc-37hq-wqr6.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-p6qc-37hq-wqr6

Aliases

CVE-2021-21646

Published

2022-05-24T17:48:06Z

Modified

2024-01-02T05:50:12Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Remote code execution vulnerability in Jenkins Templating Engine Plugin

Details

Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin.

This vulnerability allows attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

Jenkins Templating Engine Plugin 2.2 integrates with Script Security Plugin to protect its pipeline configurations.

Database specific

{
    "cwe_ids": [
        "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-13T19:28:15Z",
    "nvd_published_at": "2021-04-21T15:15:00Z",
    "severity": "HIGH"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:templating-engine

Package

Name: org.jenkins-ci.plugins:templating-engine; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/templating-engine

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.2

Affected versions

1.*

1.0

1.1

1.1.1

1.2

1.3

1.4

1.4.1

1.4.2

1.5

1.5.1

1.5.2

1.6

1.7

1.7.1

2.*

2.0-alpha

2.0-alpha2

2.0

2.0.1

2.0.2

2.0.3

2.0.4

2.1

Database specific

last_known_affected_version_range

"<= 2.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-p6qc-37hq-wqr6/GHSA-p6qc-37hq-wqr6.json"