A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade atomic-openshift-deschedulerUpgrade jenkins-2-pluginsUpgrade golang-github-prometheus-alertmanagerUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshift-cluster-autoscalerUpgrade golang-github-prometheus-prometheusUpgrade haproxyUpgrade atomic-openshift-dockerregistryUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshiftUpgrade atomic-enterprise-service-catalogUpgrade golang-github-openshift-oauth-proxyUpgrade jenkinsUpgrade openshift-ansibleUpgrade atomic-openshift-metrics-serverUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshift-web-consoleUpgrade atomic-openshift-service-idlerUpgrade openshift-enterprise-autoheal | Mar 15, 2019 | Jan 8, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
