Description
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://jenkins.io/security/advisory/2018-10-29/#SECURITY-1186
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHBA-2019:0326
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHBA-2019:0327
Scores
CVSS v3
8.8
EPSS
0.0062
EPSS Percentile
70.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-269
Status
published
Products (4)
jenkins/pipeline\
< 2.59
org.jenkins-ci.plugins/script-security
0 - 1.48Maven
org.jenkins-ci.plugins.workflow/workflow-cps
0 - 2.60Maven
redhat/openshift_container_platform
3.11
Published
Dec 10, 2018
Tracked Since
Feb 18, 2026