Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2019-10306

A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code on the Jenkins master JVM.

VectorNETWORK

PublishedApr 18, 2019, 17:29

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score9.9

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.plugins:ontrack(Maven)03.4.1N/A

References

http://www.securityfocus.com/bid/108045
https://jenkins.io/security/advisory/2019-04-17/#SECURITY-1341

Weakness Type

NVD-CWE-noinfo

CVSS Metrics

Base Score

9.9

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK