CVE-2022-43405

Опубликовано: 19 окт. 2022

Источник: nvd

CVSS3: 9.9

EPSS Низкий

Описание

A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Ссылки

http://www.openwall.com/lists/oss-security/2022/10/19/3
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%282%29
Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/10/19/3
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%282%29
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:groovy_libraries:*:*:*:*:*:jenkins:*:*

Версия до 612.v84da_9c54906d (включая)

EPSS

Процентиль: 37%

0.00157

Низкий

9.9 Critical

CVSS3

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2022-43405

CVSS3: 9.9

redhat

больше 3 лет назад

GHSA-4hjj-9gp7-4frg

CVSS3: 8.8

github