Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2019-10355

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.

VectorNETWORK

PublishedJul 31, 2019, 13:15

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.plugins:script-security(Maven)01.62N/A

References

http://www.openwall.com/lists/oss-security/2019/07/31/1
https://access.redhat.com/errata/RHSA-2019:2594
https://access.redhat.com/errata/RHSA-2019:2651
https://access.redhat.com/errata/RHSA-2019:2662
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1465%20%281%29

Weakness Type

CWE-704

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK