Description
It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well as users with e.g. Job/Configure permission in Jenkins.
Remediation
References
http://www.securityfocus.com/bid/96981
https://jenkins.io/security/advisory/2017-03-20/
Related Vulnerabilities
CVE-2022-4640 Vulnerability in maven package net.mingsoft:ms-mcms
CVE-2023-49620 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-api
CVE-2020-2287 Vulnerability in maven package org.jenkins-ci.plugins:audit-trail
CVE-2020-36181 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2019-10283 Vulnerability in maven package com.mabl.integration.jenkins:mabl-integration