CVE-2019-1003006

A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkin...

PT-2019-11306 · Jenkins · Jenkins Warnings Next Generation Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Warnings Next Generation Plugin versions 2.1.1 and earlier Description: A cross-site request forgery issue exists that allows attackers to execute arbitrary code via a form validation HTTP endpoint. The endpoint, used to validate a...

PT-2019-2297 · Jenkins · Jenkins Script Security Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Script Security Plugin versions 1.50 and earlier Description: The issue is related to errors in handling Groovy scripts, which can be exploited by a remote attacker to bypass the sandbox and execute arbitrary code on the Jenkins maste...

PT-2019-11304 · Jenkins · Jenkins Groovy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Groovy Plugin versions 2.0 and earlier Description: A sandbox bypass issue allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint, resulting in arbitrary code execution on the Jenkins master JVM...

PT-2019-11305 · Jenkins · Jenkins Warnings Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Warnings Plugin versions 5.0.0 and earlier Description: A cross-site request forgery issue exists that allows attackers to execute arbitrary code via a form validation HTTP endpoint. The issue is related to the GroovyParser.java file ...

CVE-2019-1003000

A flaw was found in Jenkins Pipeline. The Script Security sandbox protection could be circumvented during the script compilation phase by applying AST, transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are...

CloudBees Script Security Plugin Remote Code Execution Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , the tool is mainly used to monitor the order of repetitive work . Script Security is one of the plug-ins used to detect the script security . A...

Unspecified Vulnerability in CloudBees Pipeline Groovy Plugin

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. that are used to monitor order repetitive work.Pipeline:Groovy Plugin is one of the process build plugins in the Java-based continuous integration tools. . An unspecified...

CloudBees Pipeline Declarative Plugin Sandbox Bypass Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , the tool is mainly used to monitor the order of repetitive work . Pipeline: Declarative Plugin is used in one of the command generator plugin...

CVE-2019-1003001

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a...

CVE-2019-1003001

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a...

Security feature bypass

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a...

CVE-2019-1003001

Summary (CVE-2019-1003001) : Jenkins Pipeline: Groovy Plugin 2.61 and earlier contains a sandbox bypass that lets attackers with Overall/Read permission supply a pipeline script via an HTTP endpoint, enabling arbitrary code execution on the Jenkins master JVM. The issue arises from unsafe script ...

PT-2019-11302 · Jenkins · Groovy Plugin +2

Name of the Vulnerable Software and Affected Versions: Pipeline: Groovy Plugin versions 2.61 and earlier Description: A sandbox bypass issue exists that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM by providing a pipeline script to an HTTP...

Remote Code Execution Through Object Deserialization

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object. Apache Groovy 2.4.4 is the first and only supported release under the Apache Software...

Remote Code Execution (RCE)

jenkins is vulnerable to remote code execution. It was found that the combination filter Groovy script could allow a remote attacker to potentially execute arbitrary code on a Jenkins master...

Sandbox Bypass in Script Security and Pipeline Plugins

Script Security sandbox protection could be circumvented during the script compilation phase by applying AST transforming annotations such as @Grab to source code elements. Both the pipeline validation REST APIs and actual script/pipeline execution are affected. This allowed users with Overall/Re...

Jenkins ACL Bypass and Metaprogramming RCE

This module exploits a vulnerability in Jenkins dynamic routing to bypass the Overall/Read ACL and leverage Groovy metaprogramming to download and execute a malicious JAR file. When the "Java Dropper" target is selected, the original entry point based on classLoader.parseClass is used, which...

CloudBees Script Security Plugin Sandbox Bypass Vulnerability

CloudBees Script Security Plugin is the U.S. CloudBees company's Jenkins Java-based development of continuous integration tools in a plug-in for detecting script security . A sandbox bypass vulnerability exists in the groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java...

CloudBees Jenkins Pipeline: Unspecified Vulnerability in Groovy Plugin

CloudBees Jenkins formerly known as Hudson Labs is a set of Java-based continuous integration tools from CloudBees, Inc. that are used to monitor order repetitive work.Pipeline:Groovy Plugin is one of the process build plugins in the Java-based continuous integration tools. . Pipeline: Groovy...