CVE-2020-2276: 
Java vulnerability analysis and mitigation

Selection tasks Plugin 1.0 and earlier contains a system command execution vulnerability (CVE-2020-2276) that was disclosed on September 16, 2020. The plugin implements a job parameter feature that dynamically generates possible values from the output of a program, where the program path is specified in the parameter configuration. This vulnerability affects the Jenkins automation server ecosystem (Jenkins Advisory).

The vulnerability exists in the Selection tasks Plugin's implementation of job parameters. When a program path is specified as part of the parameter configuration, the plugin executes this user-specified program directly on the Jenkins controller. The severity is rated as High according to CVSS scoring system (Jenkins Advisory).

The vulnerability allows attackers with Job/Configure permission to execute arbitrary system commands on the Jenkins controller with the same privileges as the operating system user running the Jenkins process. This could lead to complete system compromise within the context of the Jenkins controller (Jenkins Advisory).

The vulnerability requires an attacker to have Job/Configure permission in Jenkins. With this permission, an attacker can specify a malicious program path in the job parameter configuration that will be executed on the Jenkins controller (Jenkins Advisory).

As of the advisory publication date, no fix was available for this vulnerability in the Selection tasks Plugin. Organizations using this plugin should carefully review and restrict Job/Configure permissions, and consider removing the plugin if not strictly necessary (Jenkins Advisory).