Description

Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.

Remediation

References

https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1710

http://www.openwall.com/lists/oss-security/2020/02/12/3

Related Vulnerabilities

CVE-2022-29214 Vulnerability in npm package next-auth

CVE-2022-39249 Vulnerability in npm package matrix-js-sdk

CVE-2023-22899 Vulnerability in maven package net.lingala.zip4j:zip4j

CVE-2016-0792 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2022-25904 Vulnerability in npm package safe-eval

Severity

Critical

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Mailing List Third Party Advisory