GHSA-xvxq-hq48-xphm GHSA-xvxq-hq48-xphm
Sandbox bypass in Script Security Plugin
- Severity
- 9.9 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 74.44%
- Chance of exploitation in the next 30 days. Higher than 99.49% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog
- Weakness
- CWE-693 Protection Mechanism Failure
- Fix
1.54- Upgrade org.jenkins-ci.plugins:script-security to this version or later
Description
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins:script-security | < 1.54 |
1.54 |
| org.jenkins-ci.plugins:script-security | < 1.54 |
1.54 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.jenkins-ci.plugins:script-security Maven → 1.54
- maven
<dependency><groupId>org.jenkins-ci.plugins</groupId><artifactId>script-security</artifactId><version>1.54</version></dependency>- gradle
implementation("org.jenkins-ci.plugins:script-security:1.54")
Severity breakdown
CVSS 3.1 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
- Exploit maturity
- H
Weakness
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-cfj9-2vgr-hpxp Jenkins Script Security Plugin has a script security bypass vulnerability | High | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-c3jm-9vj7-5v66 Jenkins Script Security Plugin sandbox bypass vulnerability | High | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-p334-gfhq-c7w6 Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths | Medium | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-jv82-75fh-23r7 Missing permission check in Jenkins Script Security Plugin | Medium | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-2g4q-9vm9-9fw4 Jenkins Script Security Plugin sandbox bypass vulnerability | High | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-v63g-v339-2673 Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies | Critical | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-76qj-9gwh-pvv3 Sandbox bypass in Jenkins Script Security Plugin | High | Also affects org.jenkins-ci.plugins:script-security |
| GHSA-fv42-mx39-6fpw Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions | High | Also affects org.jenkins-ci.plugins:script-security |
Credits: westonsteimel
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor