CVE-2022-20617

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Docker Commons Plugin	>= unspecified, <= 1.17

References

http://www.openwall.com/lists/oss-security/2022/01/12/6Mailing List, Vendor Advisory
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1878Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/01/12/6Mailing List, Vendor Advisory
https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1878Vendor Advisory

Timeline

Published: Jan 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-206184.3A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access CVE-2022-206197.1A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers t CVE-2022-20627.5Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.CVE-2022-206204.3Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials ID CVE-2022-206215.5Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where CVE-2022-206227.5A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow a CVE-2022-206237.5A vulnerability in the rate limiter for Bidirectional Forwarding Detection (BFD) traffic of Cisco NX-OS Software for Cisco Nexus 9000 Series CVE-2022-206247.5A vulnerability in the Cisco Fabric Services over IP (CFSoIP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacke CVE-2022-206254.3A vulnerability in the Cisco Discovery Protocol service of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adja CVE-2022-206265.4A vulnerability in the web-based management interface of Cisco Prime Access Registrar Appliance could allow an authenticated, remote at CVE-2022-206275.4Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica CVE-2022-206285.4Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica