CVE-2019-10355

HIGH8.8EPSS 0.04%

Incorrect Privilege Assignment in Jenkins Script Security Plugin

Published: 5/24/2022Modified: 2/16/2024

Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.

Affected packages (1)

Maven/org.jenkins-ci.plugins:script-securityfrom 0, < 1.62

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-10355
PATCHhttps://github.com/jenkinsci/script-security-plugin
WEBhttps://access.redhat.com/errata/RHSA-2019:2594
WEBhttps://access.redhat.com/errata/RHSA-2019:2651
WEBhttps://access.redhat.com/errata/RHSA-2019:2662
WEBhttps://github.com/jenkinsci/script-security-plugin/commit/5dc2e2465f309c772237a4b2de9caf61ba9b585b
WEBhttps://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465
WEBhttp://www.openwall.com/lists/oss-security/2019/07/31/1