Sandbox Bypass Affecting org.jenkins-ci.plugins:script-security package, versions [,1.50)
Threat Intelligence
Exploit Maturity
Mature
EPSS
83.77% (99th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-73604
- published 22 Jan 2019
- disclosed 22 Jan 2019
- credit Orange Tsai
Introduced: 22 Jan 2019
CVE-2019-1003000 Open this link in a new tabHow to fix?
Upgrade org.jenkins-ci.plugins:script-security to version 1.50 or higher.
Overview
org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users.
Affected versions of this package are vulnerable to Sandbox Bypass. A malicious user with Overall/Read permission, or able to control Jenkins file or sandboxed Pipeline shared library contents in SCM, could bypass the sandbox protection and execute arbitrary code on the Jenkins master.
CVSS Scores
version 3.1