CVE-2022-20617

HIGH

Jenkins Docker Commons Plugin <1.17 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-20617. PoCs published by shoucheng3.

AI-analyzed exploit summary This repository appears to be a stub or partial clone of the Jenkins Docker Commons Plugin, lacking exploit code or PoC for CVE-2022-20617. The files provided are legitimate plugin source files without offensive techniques.

Description

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.

Exploits (1)

nomisec STUB
by shoucheng3 · poc
https://github.com/shoucheng3/jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17

This repository appears to be a stub or partial clone of the Jenkins Docker Commons Plugin, lacking exploit code or PoC for CVE-2022-20617. The files provided are legitimate plugin source files without offensive techniques.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Jenkins Docker Commons Plugin
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Mailing List, Vendor Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2022/01/12/6

Scores

CVSS v3 8.8
EPSS 0.0074
EPSS Percentile 73.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
jenkins/docker_commons < 1.17
org.jenkins-ci.plugins/docker-commons 0 - 1.18Maven
Published Jan 12, 2022
Tracked Since Feb 18, 2026