GitHub Advisoryadvisory · Maven

GHSA-76qj-9gwh-pvv3 Sandbox bypass in Jenkins Script Security Plugin

HIGH Published 2023-01-26 Modified 2023-02-06 Official page ↗
Aliases
CVE-2023-24422
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:script-security
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2023-01-27

Affected packages

• Maven org.jenkins-ci.plugins:script-security: < 1229.v4880b → fixed in 1229.v4880b

Description

A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Related

Alias · CVE (1)

  • CVE-2023-24422 A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References