CVE-2020-2189: RCE vulnerability in SCM Filter Jervis Plugin
Summary
CVE-2020-2189: RCE vulnerability in SCM Filter Jervis Plugin. Affects io.jenkins.plugins:scm-filter-jervis versions < 0.3. Fixed in 0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The SCM Filter Jervis Plugin is a Maven package that provides functionality for filtering and configuring jobs in Jenkins. It allows users to control the contents of a job's SCM repository and configure filters for job configuration. This plugin is vulnerable to a remote code execution (RCE) vulnerability.
Vulnerability Detail
The SCM Filter Jervis Plugin version 0.2.1 and earlier does not properly configure its YAML parser, allowing the instantiation of arbitrary types. This vulnerability can be exploited by users who can configure jobs with the filter or control the contents of a previously configured job's SCM repository. An attacker can execute arbitrary code on the target system, potentially leading to unauthorized access, data breaches, or system compromise. The vulnerability has a CVSS score of 8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
How To Fix
Minimum fixed version
0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the plugin.
Conclusion
The SCM Filter Jervis Plugin is vulnerable to a remote code execution (RCE) vulnerability that allows attackers to execute arbitrary code on the target system. To mitigate this vulnerability, it is crucial to upgrade to SCM Filter Jervis Plugin version 0.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:scm-filter-jervis →
FAQ
This vulnerability allows an attacker to execute arbitrary code on the target system, potentially leading to unauthorized access, data breaches, or system compromise.
Users of SCM Filter Jervis Plugin versions 0.2.1 and earlier are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Yes, a fix is available in SCM Filter Jervis Plugin version 0.3 or later. It is recommended to upgrade to the fixed version.
There are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of the plugin.
