{"id":"CVE-2020-2159","aliases":["EUVD-2022-4690","GHSA-p5x5-jg3j-2jcj"],"status":"published","title":"OS command injection in CryptoMove Plugin","description":"Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02003,"percentile":0.8096,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2020-03-09T15:01:06Z","modified":"2026-10-24T10:30:27Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.jenkins.plugins:cryptomove","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.1.33"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.jenkins.plugins:cryptomove","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.1.33"}]}],"versions":["0.1.17","0.1.19","0.1.20","0.1.21","0.1.22","0.1.23","0.1.24","0.1.25","0.1.26","0.1.27","0.1.28","0.1.29","0.1.30","0.1.31","0.1.32","0.1.33"]}],"products":[{"vendor":"jenkins","product":"cryptomove"},{"vendor":"jenkins project","product":"jenkins cryptomove plugin"}],"references":[{"url":"https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1635","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2020/03/09/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2159","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p5x5-jg3j-2jcj"},{"url":"https://github.com/jenkinsci/cryptomove-plugin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-2159","description":"Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins.","status":"published","published":"2020-03-09T15:01:06Z","modified":"2024-08-04T07:01:40.936Z","updated_at":"2026-11-02T14:35:51.563355Z"}],"euvd":[{"id":"EUVD-2022-4690","description":"Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins.","status":"published","published":"2020-03-09T15:01:06Z","modified":"2024-08-04T07:01:40Z","updated_at":"2026-11-03T03:08:10.371372Z"}],"ghsa":[{"id":"GHSA-p5x5-jg3j-2jcj","title":"OS command injection in CryptoMove Plugin","description":"CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS command on the Jenkins controller.","status":"published","published":"2022-05-24T17:10:30Z","modified":"2023-01-29T05:01:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:36:25.064927Z"}],"nvd":[{"id":"CVE-2020-2159","description":"Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins.","status":"published","published":"2020-03-09T16:15:15.343Z","modified":"2026-06-17T03:11:52.437Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:05:55.32877Z"}],"osv":[{"id":"CVE-2020-2159","description":"Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins.","status":"published","published":"2020-03-09T16:15:15.343Z","modified":"2026-10-24T10:30:27.318628023Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:15.534837Z"},{"id":"GHSA-p5x5-jg3j-2jcj","title":"OS command injection in CryptoMove Plugin","description":"CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS command on the Jenkins controller.","status":"published","published":"2022-05-24T17:10:30Z","modified":"2023-11-08T04:02:53.920632Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:52.891208Z"}]}}