jenkins Vulnerabilities and Affected Products
Vulnerabilities associated with Script Security Plugin.
Products
Clear product- jenkins11 vulnerabilities
- Jenkins Code Dx Plugin5 vulnerabilities
- cas2 vulnerabilities
- Script Security Plugin2 vulnerabilities
- script_security2 vulnerabilities
- blazemeter_plugin1 vulnerability
- docker1 vulnerability
- git_server1 vulnerability
- github1 vulnerability
- gitlab_hook1 vulnerability
- groovy1 vulnerability
- icescrum1 vulnerability
- Jenkins Command Line Interface (CLI)1 vulnerability
- Jenkins Stapler Web Framework1 vulnerability
- Jenkins User Interface (UI)1 vulnerability
- jenkins-mailer-plugin1 vulnerability
- jenkins-ssh-slaves-plugin1 vulnerability
- jenkins-telegram-bot1 vulnerability
- Matrix Project Plugin1 vulnerability
- mattermost1 vulnerability
- openid1 vulnerability
- openshift-sync-plugin1 vulnerability
- pipeline\1 vulnerability
- shared_library_version_override1 vulnerability
- subversion_partial_release_manager1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2019-1003029CRITICAL | Sandbox bypass in Script Security PluginA sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. CWE-693Mar 8, 2019 | CVSS9.9v3.1 | EPSS73.9% | PoCs1 | SignalsListed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-1003000HIGH | Protection Mechanism Failure in Jenkins Script Security PluginA sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM. | CVSS8.8v3.1 | EPSS98.4% | PoCs7 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |