description: Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
affected:
{
product: Jenkins Pipeline: Multibranch Plugin
vendor: Jenkins project
versions:
status: unaffected, version: 2.26.1
status: unaffected, version: 2.23.1
status: unaffected, version: 696.698.v9b4218eea50f
lessThanOrEqual: 706.vd43c65dec013, status: affected, version: unspecified, versionType: custom
}