CVE-2022-43406

Опубликовано: 19 окт. 2022

Источник: nvd

CVSS3: 9.9

EPSS Низкий

Описание

A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Ссылки

http://www.openwall.com/lists/oss-security/2022/10/19/3
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%282%29
Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/10/19/3
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2824%20%282%29
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:groovy_libraries:*:*:*:*:*:jenkins:*:*

Версия до 583.vf3b_454e43966 (включая)

EPSS

Процентиль: 37%

0.00157

Низкий

9.9 Critical

CVSS3

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2022-43406

CVSS3: 9.9

redhat

больше 3 лет назад

GHSA-7qw2-h9gj-hcvh

CVSS3: 8.8

github