Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2019-10328

Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.

VectorNETWORK

PublishedMay 31, 2019, 15:29

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score9.9

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.plugins:workflow-remote-loader(Maven)01.5N/A

References

http://www.openwall.com/lists/oss-security/2019/05/31/2
http://www.securityfocus.com/bid/108540
https://access.redhat.com/errata/RHBA-2019:1605
https://access.redhat.com/errata/RHSA-2019:1636
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-921

Weakness Type

CWE-693

CVSS Metrics

Base Score

9.9

Vector String

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Base SeverityCritical

Version

3.0

Attack Vector (AV)

NETWORK