Jenkins Groovy Plugin sandbox bypass vulnerability

2022-05-1301:15:06

Google

osv.dev

0.001 Low

EPSS

Percentile

47.7%

JSON

A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. Groovy Plugin 2.2 uses Script Security APIs that apply sandbox protection during these phases.

CPENameOperatorVersion
org.jenkins-ci.plugins:groovyeq1.19
org.jenkins-ci.plugins:groovyeq1.9
org.jenkins-ci.plugins:groovyeq1.10
org.jenkins-ci.plugins:groovyeq1.18
org.jenkins-ci.plugins:groovyeq1.20
org.jenkins-ci.plugins:groovyeq1.11
org.jenkins-ci.plugins:groovyeq1.22
org.jenkins-ci.plugins:groovyeq1.25
org.jenkins-ci.plugins:groovyeq1.13
org.jenkins-ci.plugins:groovyeq1.30

Name	Operator	Version
org.jenkins-ci.plugins:groovy	eq	1.19
org.jenkins-ci.plugins:groovy	eq	1.9
org.jenkins-ci.plugins:groovy	eq	1.10
org.jenkins-ci.plugins:groovy	eq	1.18
org.jenkins-ci.plugins:groovy	eq	1.20
org.jenkins-ci.plugins:groovy	eq	1.11
org.jenkins-ci.plugins:groovy	eq	1.22
org.jenkins-ci.plugins:groovy	eq	1.25
org.jenkins-ci.plugins:groovy	eq	1.13
org.jenkins-ci.plugins:groovy	eq	1.30