Description

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/09/12/2

https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1538

Related Vulnerabilities

CVE-2023-36665 Vulnerability in maven package org.webjars.npm:github-com-protobufjs-protobuf-js

CVE-2020-27885 Vulnerability in maven package org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.store.feature

CVE-2022-2047 Vulnerability in maven package org.eclipse.jetty:jetty-http

CVE-2022-43404 Vulnerability in maven package org.jenkins-ci.plugins:script-security

CVE-2020-7021 Vulnerability in maven package org.elasticsearch:elasticsearch

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory NVD-CWE-Other