Back to feed
EUVD-2022-2948 · Published May 13, 2022
Protection Mechanism Failure in Jenkins Script Security Plugin A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
Technologies
Jenkins Script SecurityRedhat Openshift Container Platform
Weaknesses
NVD-CWE-OtherCWE-693
CVSS scores
- v3.18.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access Execution Privilege Escalation Stealth Credential Access Discovery Impact
References
- http://packetstormsecurity.com/files/152132/Jenkins-ACL-Bypass-Metaprogramming-Remote-Code-Execution.html
- https://www.exploit-db.com/exploits/46453/
- https://www.exploit-db.com/exploits/46572/
- https://www.exploit-db.com/exploits/46453
- https://www.exploit-db.com/exploits/46572
- http://www.rapid7.com/db/modules/exploit/multi/http/jenkins_metaprogramming
Potentially impacted assets
See if this affects your attack surface
