GitHub Advisoryadvisory · Maven
GHSA-xgjx-96v4-mqxx Jenkins Script Security Plugin allows for Bypass of Groovy Sandbox Protection
HIGH
Official page ↗
- Aliases
- CVE-2016-3102
- Ecosystem
- Maven
- Packages
- org.jenkins-ci.plugins:script-security
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Reviewed
- 2025-03-13
Affected packages
• Maven org.jenkins-ci.plugins:script-security: < 1.18.1 → fixed in 1.18.1
Description
The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.
Related
Alias · CVE (1)
- CVE-2016-3102 The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-3102 advisory
- https://github.com/jenkinsci/script-security-plugin/commit/e7d3bc9c1e25caa23cea33381134a4baaedc75b8 web
- https://github.com/jenkinsci/script-security-plugin package
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11 web