high7.5
CVE-2022-23118
Agent-to-controller security bypass in Jenkins Debian Package Builder Plugin
Impact
Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agent processes to invoke command-line git at an attacker-specified path on the controller. This allows attackers able to control agent processes to invoke arbitrary OS commands on the controller.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | ru.yandex.jenkins.plugins.debuilder:debian-package-builder | <= 1.6.11 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Debian Package Builder | through 1.6.11 |