jenkins-plugin-workflow-remote-loader: Unsafe Script Security whitelist entry in Pipeline Remote Loader Plugin (SECURITY-921)

🗓️ 16 Oct 2019 04:38:40Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

Unsafe whitelist in Jenkins Workflow Remote Loader plugin allows arbitrary method calls, bypassing.

Reporter	Title	Published	Views	Family All 25
BDU FSTEC	The vulnerability of the Jenkins Pipeline Remote Loader plugin, related to defects in the data protection mechanism, allows attackers to circumvent sandbox restrictions.	16 Jul 201900:00	–	bdu_fstec
CVE	CVE-2019-10328	31 May 201914:20	–	cve
Cvelist	CVE-2019-10328	31 May 201914:20	–	cvelist
EUVD	EUVD-2022-5283	3 Oct 202520:07	–	euvd
Github Security Blog	Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin	24 May 202222:00	–	github
NVD	CVE-2019-10328	31 May 201915:29	–	nvd
OSV	GHSA-V558-FHW2-V46W Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin	24 May 202222:00	–	osv
OSV	RHBA-2019:1605 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update	16 Sep 202402:39	–	osv
OSV	RHBA-2019:2921 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.2 RPM Release Advisory	16 Sep 202402:39	–	osv
OSV	RHSA-2019:1636 Red Hat Security Advisory: OpenShift Container Platform 4.1 jenkins-2-plugins security update	16 Sep 202402:41	–	osv

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	noarch	jenkins-2-plugins	4.2.1568997376-1.el7	jenkins-2-plugins-4.2.1568997376-1.el7.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2019-10328
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
jenkins	www.jenkins.io/security/advisory/2019-05-31/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-10328
cve	www.cve.org/CVERecord

27 Jun 2026 00:54Current

6.7Medium risk

Vulners AI Score6.7

CVSS 26.5

CVSS 39.9

EPSS0.01938

Jenkins Workflow Remote Loader unsafe whitelist arbitrary method calls sandbox bypass