OS command execution vulnerability in Jenkins Docker Commons Plugin

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.

Vulnerability ID: GHSA-jpxj-vgq5-prjc
Aliases: CVE-2022-20617
Published: 2022-01-13 00:01:03
CWE: CWE-78
Severity rating: HIGH
CVSS: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven
name: org.jenkins-ci.plugins:docker-commons