Jenkins Pipeline Classpath Step plugin allowed Script Security sandbox bypass

2022-05-1301:36:51

Google

osv.dev

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.4%

JSON

It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well as users with e.g. Job/Configure permission in Jenkins.

CPENameOperatorVersion
cprice404:pipeline-classpatheq0.1.0

CPE	Name	Operator	Version
	cprice404:pipeline-classpath	eq	0.1.0

References

www.securityfocus.com/bid/96981

jenkins.io/security/advisory/2017-03-20

nvd.nist.gov/vuln/detail/CVE-2017-2650