CVE-2017-1000095

2017-10-0501:29:03

Google

osv.dev

6.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

28.6%

JSON

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild[‘rawBuild’] rather than currentBuild.rawBuild. Additionally, the following entries allowed accessing private data that would not be accessible otherwise due to script security: groovy.json.JsonOutput.toJson(Closure); groovy.json.JsonOutput.toJson(Object).

CPENameOperatorVersion
script-security-plugineqscript-security-1.28
script-security-plugineqscript-security-1.5
script-security-plugineqscript-security-1.34
script-security-plugineqscript-security-1.19
script-security-plugineqscript-security-1.9
script-security-plugineqscript-security-1.4
script-security-plugineqscript-security-1.18
script-security-plugineqscript-security-1.8
script-security-plugineqscript-security-1.20
script-security-plugineqscript-security-1.0-beta-4

Name	Operator	Version
script-security-plugin	eq	script-security-1.28
script-security-plugin	eq	script-security-1.5
script-security-plugin	eq	script-security-1.34
script-security-plugin	eq	script-security-1.19
script-security-plugin	eq	script-security-1.9
script-security-plugin	eq	script-security-1.4
script-security-plugin	eq	script-security-1.18
script-security-plugin	eq	script-security-1.8
script-security-plugin	eq	script-security-1.20
script-security-plugin	eq	script-security-1.0-beta-4