CVE-2019-16538

Опубликовано: 21 нояб. 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.

Ссылки

http://www.openwall.com/lists/oss-security/2019/11/21/1
Mailing List
Third Party Advisory
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1658
Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/11/21/1
Mailing List
Third Party Advisory
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1658
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:script_security:*:*:*:*:*:jenkins:*:*

Версия до 1.67 (включая)

EPSS

Процентиль: 39%

0.00176

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-863

Связанные уязвимости

CVE-2019-16538

CVSS3: 8.8

redhat

около 6 лет назад

GHSA-62pm-mgrh-7p69

CVSS3: 8.8

github

больше 3 лет назад

Incorrect Authorization in Jenkins Script Security Plugin

EPSS

Процентиль: 39%

0.00176

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-863