Sandbox bypass through type casts in script-security

🗓️ 31 Jul 2019 00:00:00Reported by Jenkins Security TeamType

Sandbox bypass via type casts; limits collection casts to java.util and uses file or enum casts as arrays.

Reporter	Title	Published	Views	Family All 22
BDU FSTEC	The vulnerability of the Jenkins Script Security plugin, related to incorrect type conversion, allows attackers to execute arbitrary code or gain unauthorized access to confidential information.	13 Aug 201900:00	–	bdu_fstec
CNVD	CloudBees Jenkins Script Security plugin security feature issue vulnerability (CNVD-2019-26374)	2 Aug 201900:00	–	cnvd
CVE	CVE-2019-10355	31 Jul 201912:45	–	cve
Cvelist	CVE-2019-10355	31 Jul 201912:45	–	cvelist
EUVD	EUVD-2022-4680	3 Oct 202520:07	–	euvd
Github Security Blog	Incorrect Privilege Assignment in Jenkins Script Security Plugin	24 May 202216:51	–	github
NVD	CVE-2019-10355	31 Jul 201913:15	–	nvd
OSV	GHSA-P56J-X44H-G66J Incorrect Privilege Assignment in Jenkins Script Security Plugin	24 May 202216:51	–	osv
OSV	RHSA-2019:2651 Red Hat Security Advisory: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update	16 Sep 202402:51	–	osv
OSV	RHSA-2019:2662 Red Hat Security Advisory: Red Hat OpenShift Container Platform 4.1 jenkins-2-plugins security update	16 Sep 202402:51	–	osv