Description

A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed.

Remediation

References

https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186

https://access.redhat.com/errata/RHBA-2019:0326

https://access.redhat.com/errata/RHBA-2019:0327

Related Vulnerabilities

CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-beam-sql

CVE-2022-31170 Vulnerability in npm package @openzeppelin/contracts

CVE-2015-8131 Vulnerability in npm package kibana

CVE-2023-26155 Vulnerability in npm package node-qpdf

CVE-2019-19466 Vulnerability in npm package sceditor

Severity

Critical

Classification

CWE-269 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Third Party Advisory