Description

A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/08/28/4

https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1294

Related Vulnerabilities

CVE-2020-25649 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2020-7768 Vulnerability in maven package org.webjars.npm:grpc

CVE-2020-28434 Vulnerability in npm package gitblame

CVE-2018-1000861 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2020-14446 Vulnerability in maven package org.wso2.carbon.identity.framework:org.wso2.carbon.identity.entitlement.ui

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory NVD-CWE-Other