CloudBees, Inc.

3 exploits Active since Jan 2019
CVE-2024-43044 NOMISEC HIGH WORKING POC
Jenkins <2.470 - Info Disclosure
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.
2 stars
CVSS 8.8
CVE-2022-25175 NOMISEC HIGH WRITEUP
Jenkins Pipeline < 706.vd43c65dec013 - OS Command Injection
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents.
CVSS 8.8
CVE-2019-1003000 NOMISEC HIGH WRITEUP
Script Security Plugin <1.49 - RCE
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
CVSS 8.8