Description
It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well as users with e.g. Job/Configure permission in Jenkins.
Remediation
References
http://www.securityfocus.com/bid/96981
https://jenkins.io/security/advisory/2017-03-20/
Related Vulnerabilities
CVE-2020-10672 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2021-4040 Vulnerability in maven package org.apache.activemq:artemis-core-client
CVE-2022-43441 Vulnerability in npm package sqlite3
CVE-2017-12158 Vulnerability in maven package org.keycloak:keycloak-server-spi-private
CVE-2017-14063 Vulnerability in maven package org.asynchttpclient:async-http-client-project