aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +245 more potentially affected by CVE-2018-1000866 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.46)

org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2018-1000866 Source advisory: OSV:GHSA-GQHM-4H93-RRHG...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +245 more potentially affected by CVE-2018-1000866 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.46)

org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2018-1000866 Source advisory: GHSA-GQHM-4H93-RRHG...

org.jenkins-ci.plugins.workflow:workflow-aggregator (0.1-beta-6), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (0.1-beta-6) potentially affected by CVE-2018-1000866 via org.jenkins-ci.plugins.workflow:workflow-cps (0.1-beta-6)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 0.1-beta-6 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 0.1-beta-6 -...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.4), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.4) +2 more potentially affected by CVE-2018-1000866 via org.jenkins-ci.plugins.workflow:workflow-cps (1.4)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.4 -...

com.btc.ep:btc-embeddedplatform (>=1.9.2-beta, <=2.5.9), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.13) +8 more potentially affected by CVE-2018-1000866 via org.jenkins-ci.plugins.workflow:workflow-cps (1.13)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - com.btc.ep:btc-embeddedplatform =1.9.2-beta, =2.0, =1.4, =1.12.1, =2.2,...

com.synopsys.jenkinsci:ownership (>=0.9.0-beta-1, <=0.13.0), org.jenkins-ci.plugins.pipeline-stage-view:parent-pom (1.0) +9 more potentially affected by CVE-2018-1000866 via org.jenkins-ci.plugins.workflow:workflow-cps (1.14)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - com.synopsys.jenkinsci:ownership =0.9.0-beta-1, =1.0, =1.2.0, =1.2.7 -...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.10), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.10) +2 more potentially affected by CVE-2018-1000866 via org.jenkins-ci.plugins.workflow:workflow-cps (1.10)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.10 -...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.14.1-beta-1), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.14.1-beta-1) +1 more potentially affected by CVE-2018-1000866 via org.jenkins-ci.plugins.workflow:workflow-cps (1.14.1-beta-1)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.14.1-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.14.1-beta...

org.jenkins-ci.plugins.workflow:workflow-aggregator (1.12), org.jenkins-ci.plugins.workflow:workflow-cps-global-lib (1.12) +1 more potentially affected by CVE-2018-1000866 via org.jenkins-ci.plugins.workflow:workflow-cps (1.12)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 1.12 -...

CVE-2018-1000866

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permissio...

CVE-2018-1000866

CVE-2018-1000866 describes a sandbox bypass in Jenkins Pipeline: Groovy Plugin 2.59 and earlier. The vulnerability stems from SandboxTransformer.java and SandboxCpsTransformer.java, enabling code execution on the Jenkins master JVM when an attacker has Job/Configure permissions or SCM commit priv...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +245 more potentially affected by CVE-2018-1000866 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.46)

org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2018-1000866 Source advisory: MEND:CVE-2018-1000866...