Description
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/10/01/2
https://access.redhat.com/errata/RHSA-2019:4055
https://access.redhat.com/errata/RHSA-2019:4089
https://access.redhat.com/errata/RHSA-2019:4097
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1579
Related Vulnerabilities
CVE-2020-7697 Vulnerability in npm package mock2easy
CVE-2019-18212 Vulnerability in maven package org.lsp4xml:org.eclipse.lsp4xml.extensions.emmet
CVE-2022-45399 Vulnerability in maven package org.zeroturnaround:cluster-stats
CVE-2020-7645 Vulnerability in npm package chrome-launcher
CVE-2020-2189 Vulnerability in maven package org.jenkins-ci.plugins:scm-filter-jervis