CVE-2016-3102

HIGH7.3EPSS 0.05%

Jenkins Script Security Plugin allows for Bypass of Groovy Sandbox Protection

Published: 5/17/2022Modified: 3/13/2025

Description

The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.

Affected packages (1)

Maven/org.jenkins-ci.plugins:script-securityfrom 0, < 1.18.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-3102
PATCHhttps://github.com/jenkinsci/script-security-plugin
WEBhttps://github.com/jenkinsci/script-security-plugin/commit/e7d3bc9c1e25caa23cea33381134a4baaedc75b8
WEBhttps://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11