GitHub Advisoryadvisory · Maven

GHSA-mqc2-w9r8-mmxm Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution

CRITICAL Published 2022-10-19 Modified 2022-10-22 Official page ↗
Aliases
CVE-2022-43402
Ecosystem
Maven
Packages
org.jenkins-ci.plugins.workflow:workflow-cps
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-693
Reviewed
2022-10-19

Affected packages

• Maven org.jenkins-ci.plugins.workflow:workflow-cps: < 2803.v1a_f77ffcc773 → fixed in 2803.v1a_f77ffcc773

Description

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Pipeline: Groovy Plugin 2803.v1a_f77ffcc773 intercepts Groovy casts performed implicitly by the Groovy language runtime

Related

Alias · CVE (1)

  • CVE-2022-43402 A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy… vulnerability

Weakness · CWE (1)

  • CWE-693 Protection Mechanism Failure weakness

References