Description
Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively elevating privileges to Overall/Run Scripts.
Remediation
References
https://jenkins.io/security/advisory/2017-10-11/
Related Vulnerabilities
CVE-2016-8749 Vulnerability in maven package org.apache.camel:camel-jacksonxml
CVE-2023-50730 Vulnerability in maven package org.typelevel:grackle-core_2.13
CVE-2023-40176 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates
CVE-2021-20218 Vulnerability in maven package io.fabric8:kubernetes-client
CVE-2021-3536 Vulnerability in maven package org.wildfly:wildfly-parent