Sandbox bypass vulnerability in Jenkins Script Security Plugin

GHSA-76q7-r3g4-wvm4 · CVE-2019-10400

Published May 24, 2022 · Modified Nov 30, 2024

Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-10400
WEB https://github.com/jenkinsci/script-security-plugin/commit/b28e4dc5584ef6515aeb9bc834691176546d0689
PACKAGE https://github.com/jenkinsci/script-security-plugin
WEB https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538
WEB http://www.openwall.com/lists/oss-security/2019/09/12/2

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes