Sandbox bypass in ontrack Jenkins Plugin

2022-05-2416:43:54

Google

osv.dev

0.001 Low

EPSS

Percentile

47.7%

JSON

A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code on the Jenkins master JVM.

CPENameOperatorVersion
org.jenkins-ci.plugins:ontrackeq2.19.0
org.jenkins-ci.plugins:ontrackeq2.13.2
org.jenkins-ci.plugins:ontrackeq2.17.0
org.jenkins-ci.plugins:ontrackeq2.28.0
org.jenkins-ci.plugins:ontrackeq2.31.3
org.jenkins-ci.plugins:ontrackeq2.32.5
org.jenkins-ci.plugins:ontrackeq2.30.3
org.jenkins-ci.plugins:ontrackeq2.6.0
org.jenkins-ci.plugins:ontrackeq2.29.1
org.jenkins-ci.plugins:ontrackeq2.32.4

Name	Operator	Version
org.jenkins-ci.plugins:ontrack	eq	2.19.0
org.jenkins-ci.plugins:ontrack	eq	2.13.2
org.jenkins-ci.plugins:ontrack	eq	2.17.0
org.jenkins-ci.plugins:ontrack	eq	2.28.0
org.jenkins-ci.plugins:ontrack	eq	2.31.3
org.jenkins-ci.plugins:ontrack	eq	2.32.5
org.jenkins-ci.plugins:ontrack	eq	2.30.3
org.jenkins-ci.plugins:ontrack	eq	2.6.0
org.jenkins-ci.plugins:ontrack	eq	2.29.1
org.jenkins-ci.plugins:ontrack	eq	2.32.4