Sandbox bypass vulnerability in Script Security Plugin

GHSA-9fp8-64xf-w957 · CVE-2019-10393

Published May 24, 2022 · Modified Nov 30, 2024

Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-10393
WEB https://github.com/jenkinsci/script-security-plugin/commit/b28e4dc5584ef6515aeb9bc834691176546d0689
PACKAGE https://github.com/jenkinsci/script-security-plugin
WEB https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538
WEB http://www.openwall.com/lists/oss-security/2019/09/12/2

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes