GHSA-xgjx-96v4-mqxx

ghsaUSosv

Jenkins Script Security Plugin allows for Bypass of Groovy Sandbox Protection

view advisory published 2022-05-17Licence: CC-BY-4.0

The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2016-3102US	high7.3	1.77% (78th)	—	2017-02-09
The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access…

references

External citations — patches, advisories, analysis.

https://github.com/jenkinsci/script-security-pluginPACKAGE
https://github.com/jenkinsci/script-security-plugin/commit/e7d3bc9c1e25caa23cea33381134a4baaedc75b8WEB
https://nvd.nist.gov/vuln/detail/CVE-2016-3102ADVISORY
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan