Script security sandbox bypass in Jenkins Email Extension Plugin

2022-05-1301:15:06

Google

osv.dev

0.001 Low

EPSS

Percentile

47.7%

JSON

A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.

CPENameOperatorVersion
org.jenkins-ci.plugins:email-exteq2.59
org.jenkins-ci.plugins:email-exteq2.43
org.jenkins-ci.plugins:email-exteq2.63
org.jenkins-ci.plugins:email-exteq2.28
org.jenkins-ci.plugins:email-exteq2.40
org.jenkins-ci.plugins:email-exteq2.37.2.2
org.jenkins-ci.plugins:email-exteq2.38.2
org.jenkins-ci.plugins:email-exteq2.41.3
org.jenkins-ci.plugins:email-exteq2.57.2
org.jenkins-ci.plugins:email-exteq2.14.1

Name	Operator	Version
org.jenkins-ci.plugins:email-ext	eq	2.59
org.jenkins-ci.plugins:email-ext	eq	2.43
org.jenkins-ci.plugins:email-ext	eq	2.63
org.jenkins-ci.plugins:email-ext	eq	2.28
org.jenkins-ci.plugins:email-ext	eq	2.40
org.jenkins-ci.plugins:email-ext	eq	2.37.2.2
org.jenkins-ci.plugins:email-ext	eq	2.38.2
org.jenkins-ci.plugins:email-ext	eq	2.41.3
org.jenkins-ci.plugins:email-ext	eq	2.57.2
org.jenkins-ci.plugins:email-ext	eq	2.14.1