CVE-2022-20617
HIGHJenkins Docker Commons Plugin <1.17 - Command Injection
Title source: llmDescription
Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.
Exploits (1)
nomisec
STUB
by shoucheng3 · poc
https://github.com/shoucheng3/jenkinsci__docker-commons-plugin_CVE-2022-20617_1-17
Scores
CVSS v3
8.8
EPSS
0.0074
EPSS Percentile
73.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (2)
jenkins/docker_commons
< 1.17
org.jenkins-ci.plugins/docker-commons
0 - 1.18Maven
Published
Jan 12, 2022
Tracked Since
Feb 18, 2026