CVEvulnerability
CVE-2022-43406
9.9 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-10-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Description
A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Affected configurations
• jenkins groovy libraries (<= 583.vf3b 454e43966)
References
- http://www.openwall.com/lists/oss-security/2022/10/19/3 Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%282%29 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/10/19/3 Mailing List, Third Party Advisory
- https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%282%29 Vendor Advisory