Description
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scripts to provide crafted return values or script binding content that can result in arbitrary code execution on the Jenkins controller JVM.
Remediation
References
http://www.openwall.com/lists/oss-security/2020/09/23/1
https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-2020
Related Vulnerabilities
CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-elasticsearch
CVE-2023-25767 Vulnerability in maven package org.jenkins-ci.plugins:azure-credentials
CVE-2016-4465 Vulnerability in maven package org.apache.struts.xwork:xwork-core
CVE-2022-2047 Vulnerability in maven package org.eclipse.jetty:jetty-http
CVE-2023-29215 Vulnerability in maven package org.apache.linkis:linkis-engineplugin-jdbc