CVE-2020-2211: RCE vulnerability in ElasticBox Jenkins Kubernetes CI/CD Plugin
8.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.73202%
CWE
Published
5/24/2022
Updated
1/28/2023
KEV Status
No
Technology
Java
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.elasticbox.jenkins-ci.plugins:kubernetes-ci | maven | <= 1.3 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
While exact function names/paths aren't provided in disclosures, the vulnerability root cause is clearly identified as unsafe YAML deserialization configuration. In Java/YAML contexts, this typically manifests in functions that: 1) Use default YAML.load() methods without type filtering 2) Fail to set a SafeConstructor 3) Process untrusted YAML input. The high confidence comes from the advisory's explicit statement about missing parser configuration for type restrictions - a known antipattern in deserialization vulnerabilities.