CVEvulnerability
CVE-2019-10458
9.9 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-10-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Description
Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.
Affected configurations
• jenkins puppet enterprise pipeline (<= 1.3.1)
Related
Referenced by CWE · observed example (1)
- CWE-183 Permissive List of Allowed Inputs weakness
References
- https://jenkins.io/security/advisory/2019-10-16/#SECURITY-918 Vendor Advisory
- https://jenkins.io/security/advisory/2019-10-16/#SECURITY-918 Vendor Advisory