Azure Cli
Monthly
Arbitrary shell command execution on the Jenkins controller is possible through the Azure CLI Plugin 0.9 and earlier, which does not restrict which commands it runs. An authenticated Jenkins user holding Item/Configure permission can craft a job configuration that causes the plugin to execute attacker-chosen shell commands on the controller, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires no user interaction and no non-default plugin setting. There is no evidence of active exploitation and no public exploit identified at time of analysis, and EPSS is low (0.61%, 48th percentile), though the required privilege is comparatively common in environments where job-configuration rights are broadly granted.
Arbitrary shell command execution on the Jenkins controller is possible through the Azure CLI Plugin 0.9 and earlier, which does not restrict which commands it runs. An authenticated Jenkins user holding Item/Configure permission can craft a job configuration that causes the plugin to execute attacker-chosen shell commands on the controller, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires no user interaction and no non-default plugin setting. There is no evidence of active exploitation and no public exploit identified at time of analysis, and EPSS is low (0.61%, 48th percentile), though the required privilege is comparatively common in environments where job-configuration rights are broadly granted.