Sandbox Bypass Vulnerability in Jenkins Email Extension Plugin
CVE-2019-1003032

9.9CRITICAL

Key Information:

Vendor

Jenkins
Status
Jenkins Email Extension Plugin
Vendor
CVE Published:
8 March 2019

What is CVE-2019-1003032?

A sandbox bypass vulnerability in the Jenkins Email Extension Plugin enables attackers with Job/Configure permission to execute arbitrary code on the master Jenkins JVM. This flaw affects versions 2.64 and earlier, potentially allowing unauthorized access and manipulation of Jenkins configurations through various scripts included in the plugin. Proper security measures should be implemented to mitigate risks associated with this vulnerability.

Affected Version(s)

Jenkins Email Extension Plugin 2.64 and earlier

References

https://jenkins.io/security/advisory/2019-03-06/#SECURITY...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/107476
vdb-entryx_refsource_BID

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.