Sandbox Bypass in Jenkins Pipeline: Deprecated Groovy Libraries Plugin by Jenkins
CVE-2022-43406

9.9CRITICAL

Key Information:

Vendor
Jenkins
Status
Jenkins Pipeline: Deprecated Groovy Libraries Plugin
Vendor
CVE Published:
19 October 2022

Summary

A sandbox bypass vulnerability in the Jenkins Pipeline: Deprecated Groovy Libraries Plugin allows authorized users to define untrusted Pipeline libraries and execute scripts outside the security constraints of the sandbox. This can result in arbitrary code execution within the Jenkins controller JVM, posing significant risks to the integrity of the Jenkins environment and its underlying systems.

Affected Version(s)

Jenkins Pipeline: Deprecated Groovy Libraries Plugin <= 583.vf3b_454e43966

References

https://www.jenkins.io/security/advisory/2022-10-19/#SECU...
http://www.openwall.com/lists/oss-security/2022/10/19/3
mailing-list

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.