CVEvulnerability
CVE-2019-10431
9.9 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-10-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
Affected configurations
• jenkins script security (<= 1.64)
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://www.openwall.com/lists/oss-security/2019/10/01/2 Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4055 access.redhat.com
- https://access.redhat.com/errata/RHSA-2019:4089 access.redhat.com
- https://access.redhat.com/errata/RHSA-2019:4097 access.redhat.com
- https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1579 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/10/01/2 Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4055 access.redhat.com
- https://access.redhat.com/errata/RHSA-2019:4089 access.redhat.com
- https://access.redhat.com/errata/RHSA-2019:4097 access.redhat.com
- https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1579 Vendor Advisory