Improper Non-Trusted Input Validation Affecting org.jenkins-ci.plugins:script-security package, versions [0,]
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-6807579
- published 3 May 2024
- disclosed 3 May 2024
- credit Devin Nusbaum
Introduced: 3 May 2024
CVE-2024-34144 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users.
Affected versions of this package are vulnerable to Improper Non-Trusted Input Validation due to crafted constructor bodies that invoke other constructors can be used to construct any subclassable type via implicit casts.
Notes:
These issues are caused by an incomplete fix of SECURITY-2824
This vulnerability is fixed in Script Security Plugin 1336.vf33a_a_9863911.