CVE-2022-41237 - Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability

Back Back to CVE browser

CRITICAL

Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability

Published Sep 21, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.67%

Description

Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

Affected products

Vendor Jenkins project Product Jenkins DotCi Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=2.40.00

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins DotCi Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=2.40.00

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6974
Advisory
https://github.com/advisories/GHSA-x3jj-rgw9-7r5g
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41237
https://plugins.jenkins.io/DotCi/
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-1737
x_refsource_CONFIRMVendor Advisory
https://www.jenkins.io/security/plugins/#suspensions

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6974		Advisory
https://github.com/advisories/GHSA-x3jj-rgw9-7r5g		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41237
https://plugins.jenkins.io/DotCi/
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-1737		x_refsource_CONFIRMVendor Advisory
https://www.jenkins.io/security/plugins/#suspensions