Sandbox bypass vulnerability in Jenkins Script Security Plugin

GHSA-m26f-w3h5-62fj · CVE-2019-10399

Published May 24, 2022 · Modified Nov 30, 2024

Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-10399
WEB https://github.com/jenkinsci/script-security-plugin/commit/b28e4dc5584ef6515aeb9bc834691176546d0689
PACKAGE https://github.com/jenkinsci/script-security-plugin
WEB https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538
WEB http://www.openwall.com/lists/oss-security/2019/09/12/2

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes