Description
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
Remediation
References
http://www.openwall.com/lists/oss-security/2019/10/01/2
https://access.redhat.com/errata/RHSA-2019:4055
https://access.redhat.com/errata/RHSA-2019:4089
https://access.redhat.com/errata/RHSA-2019:4097
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1579
Related Vulnerabilities
CVE-2020-7691 Vulnerability in maven package org.webjars.npm:jspdf
CVE-2020-6858 Vulnerability in maven package com.hotels.styx:styx-api
CVE-2021-32808 Vulnerability in maven package org.webjars.npm:ckeditor4
CVE-2020-36048 Vulnerability in maven package org.webjars.bower:engine.io
CVE-2019-16776 Vulnerability in maven package org.webjars:npm