CVEvulnerability
CVE-2019-10380
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-08-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Description
Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.
Affected configurations
• jenkins simple travis pipeline runner (<= 1.0)
References
- http://www.openwall.com/lists/oss-security/2019/08/07/1 Mailing List, Third Party Advisory
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/08/07/1 Mailing List, Third Party Advisory
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-922 Vendor Advisory