Sandbox bypass in Jenkins Pipeline: Groovy Plugin

2022-05-1301:14:26

Google

osv.dev

0.006 Low

EPSS

Percentile

78.0%

JSON

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.

CPENameOperatorVersion
org.jenkins-ci.plugins.workflow:workflow-cpseq2.13
org.jenkins-ci.plugins.workflow:workflow-cpseq0.1-beta-8
org.jenkins-ci.plugins.workflow:workflow-cpseq2.10
org.jenkins-ci.plugins.workflow:workflow-cpseq2.18
org.jenkins-ci.plugins.workflow:workflow-cpseq2.16
org.jenkins-ci.plugins.workflow:workflow-cpseq1.7
org.jenkins-ci.plugins.workflow:workflow-cpseq2.31
org.jenkins-ci.plugins.workflow:workflow-cpseq2.3
org.jenkins-ci.plugins.workflow:workflow-cpseq2.21
org.jenkins-ci.plugins.workflow:workflow-cpseq2.30-stepstorage2-alpha

Name	Operator	Version
org.jenkins-ci.plugins.workflow:workflow-cps	eq	2.13
org.jenkins-ci.plugins.workflow:workflow-cps	eq	0.1-beta-8
org.jenkins-ci.plugins.workflow:workflow-cps	eq	2.10
org.jenkins-ci.plugins.workflow:workflow-cps	eq	2.18
org.jenkins-ci.plugins.workflow:workflow-cps	eq	2.16
org.jenkins-ci.plugins.workflow:workflow-cps	eq	1.7
org.jenkins-ci.plugins.workflow:workflow-cps	eq	2.31
org.jenkins-ci.plugins.workflow:workflow-cps	eq	2.3
org.jenkins-ci.plugins.workflow:workflow-cps	eq	2.21
org.jenkins-ci.plugins.workflow:workflow-cps	eq	2.30-stepstorage2-alpha