Improper Input Validation in Jenkins Script Security Plugin

GHSA-qvmf-36h5-3f5v · CVE-2020-2110

Published May 24, 2022 · Modified Feb 16, 2024

Description

Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-2110
WEB https://github.com/jenkinsci/script-security-plugin/commit/1a09bdcf789b87c4e158aacebd40937c64398de3
WEB https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1713
WEB http://www.openwall.com/lists/oss-security/2020/02/12/3

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes