Sandbox Bypass Vulnerability in Jenkins Script Security Plugin Allows Arbitrary Code Execution

CVE-2024-34144
Currently unrated 🤨

Key Information

Vendor
Jenkins
Status
Jenkins Script Security Plugin
Vendor
CVE Published:
2 May 2024

Badges

👾 Exploit Exists

Summary

A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Affected Version(s)

Jenkins Script Security Plugin <= 1335.vf07d9ce377a_e

Timeline

  • 👾

    Exploit exists.

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database0 Proof of Concept(s)
.