What is CVE-2023-28677?

CVE-2023-28677 is a critical-severity vulnerability in Jenkins Convert To Pipeline, classified under Command Injection. CVSS score: 9.8/10. Published 2023-04-02.

How severe is CVE-2023-28677?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Jenkins Convert To Pipeline

CVE-2023-28677

Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a convertion by Jenkins Convert To Pipeline Plugin.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.008 (52.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Jenkins Convert_to_pipeline
Jenkins Project Convert To Pipeline Plugin — versions 0

Weakness classification (CWE)

CWE-77 — Command Injection

References

jenkinsci-cert@googlegroups.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2023-28677?: CVE-2023-28677 is a critical-severity vulnerability in Jenkins Convert To Pipeline, classified under Command Injection. CVSS score: 9.8/10. Published 2023-04-02.
How severe is CVE-2023-28677?: Critical severity. CVSS v3 base score is 9.8 out of 10.