GitHub Advisoryadvisory · Maven

GHSA-x7p9-vx6v-wv84 Jenkins Simple Travis Pipeline Runner Plugin script sandbox bypass vulnerability

HIGH Published 2022-05-24 Modified 2023-10-26 Official page ↗
Aliases
CVE-2019-10380
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:simple-travis-runner
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Reviewed
2023-10-26

Affected packages

• Maven org.jenkins-ci.plugins:simple-travis-runner: <= 1.0 (no fix yet)

Description

Jenkins Simple Travis Pipeline Runner Plugin defines a custom list of pre-approved signatures for scripts protected by the Script Security sandbox. This custom list of pre-approved signatures allows the use of methods that can be used to bypass Script Security sandbox protection. This results in arbitrary code execution on any Jenkins instance with this plugin installed. As of publication of this advisory, there is no fix.

Related

Alias · CVE (1)

  • CVE-2019-10380 Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing… vulnerability

References