Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-5r74-pgmq-92mm

Опубликовано: 13 мая 2022
Источник: github
Github: Прошло ревью
CVSS3: 9.9

Описание

Script security sandbox bypass in Jenkins Job DSL Plugin

A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.

Пакеты

Наименование

org.jenkins-ci.plugins:job-dsl

maven
Затронутые версииВерсия исправления

< 1.72

1.72

EPSS

Процентиль: 83%
0.01879
Низкий

9.9 Critical

CVSS3

Дефекты

CWE-693

Связанные уязвимости

CVSS3: 8.8
redhat
почти 7 лет назад

A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.

CVSS3: 9.9
nvd
почти 7 лет назад

A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.

CVSS3: 9.9
fstec
почти 7 лет назад

Уязвимость компонентов AbstractDslScriptLoader.groovy, JobDslWhitelist.groovy, SandboxDslScriptLoader.groovy плагина Jenkins Job DSL, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 83%
0.01879
Низкий

9.9 Critical

CVSS3

Дефекты

CWE-693