Sandbox Circumvention in Jenkins Script Security Plugin
CVE-2020-2134

8.8HIGH

Key Information:

Vendor
Jenkins
Status
Jenkins Script Security Plugin
Vendor
CVE Published:
9 March 2020

Summary

A significant vulnerability exists in the Jenkins Script Security Plugin versions 1.70 and earlier, where sandbox protection mechanisms can be bypassed. This vulnerability enables attackers to execute arbitrary code by using crafted constructor calls and constructor bodies, undermining the safety net provided by the sandbox environment. It poses risks to secure software development practices, allowing potentially malicious code to run unchecked, which can lead to unauthorized access or data breaches. Developers and administrators using affected versions should consider upgrading to ensure robust security.

Affected Version(s)

Jenkins Script Security Plugin <= 1.70

References

https://jenkins.io/security/advisory/2020-03-09/#SECURITY...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2020/03/09/1
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.