Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.

Remediation

References

https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1658

http://www.openwall.com/lists/oss-security/2019/11/21/1

Related Vulnerabilities

CVE-2021-27290 Vulnerability in maven package org.webjars.npm:ssri

CVE-2023-48796 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-alert-server

CVE-2022-31186 Vulnerability in npm package next-auth

CVE-2022-31147 Vulnerability in maven package org.webjars.npm:jquery-validation

CVE-2023-38695 Vulnerability in npm package @simonsmith/cypress-image-snapshot

Severity

Critical

Classification

CWE-863 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Mailing List Third Party Advisory