Description
A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/08/28/4
https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1294
Related Vulnerabilities
CVE-2020-1951 Vulnerability in maven package org.apache.tika:tika-parsers
CVE-2021-3461 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2020-7611 Vulnerability in maven package io.micronaut:micronaut-http-client
CVE-2019-10322 Vulnerability in maven package org.jenkins-ci.plugins:artifactory
CVE-2017-5645 Vulnerability in maven package org.apache.logging.log4j:log4j-core