jenkinsci__script-security-plugin_CVE-2023-24422_1228.vd93135a_2fb_25

脚本安全插件 用户指南 （改编自 CloudBees 插件指南中 模板插件 的信息） 多个 Jenkins 插件要求用户定义自定义脚本，最常见的是使用 Groovy 语言，以定制 Jenkins 的行为。如果编写这些脚本的每个人都是 Jenkins 管理员——特别是拥有 Overall/RunScripts 权限（例如脚本控制台链接所使用的权限）——那么他们可以编写任何他们喜欢的脚本。这些脚本可以使用插件所用的相同 API 直接引用 Jenkins 内部对象。这类用户必须完全受信任，因为他们可以对 Jenkins 做任何事情（甚至更改其安全设置或在服务器上运行 shell 命令）。...

CVE-2026-84658

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

CVE-2026-84658

The Jenkins Script Security Plugin (versions 1412.v7737b_3405f86 and earlier) contains a vulnerability where a constructor used to load script approval configuration is incorrectly annotated with @DataBoundConstructor . This oversight in the Stapler web framework's data-binding mechanism allows a...

CVE-2026-84658

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

EUVD-2026-70124

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

CVE-2026-84658: Exposure of Sensitive Information to an Unauthorized Actor

Jenkins Script Security Plugin 1412.v7737b3405f86 and earlier uses the @DataBoundConstructor annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuration...

PT-2026-84781

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1412.v7737b 3405f86 Description The software uses the @DataBoundConstructor annotation on a constructor responsible for loading script approval configuration. This allows attackers who can submi...

Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, instantiating any type with a constructor annotated with @DataBoundConstructor in response to a request. This allows attackers to have...

Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability

Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, instantiating any type with a constructor annotated with @DataBoundConstructor in response to a request. This allows attackers to have...

EUVD-2022-4918

Malicious code in bioql PyPI...

jenkins-plugin/pipeline-model-definition: Jenkins Pipeline Declarative Plugin Allows Restart of Builds with Unapproved Jenkinsfile

A flaw was found in Jenkins Pipeline: Declarative Plugin pipeline-model-definition. This vulnerability allows attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer approved via insufficient script approval checks...

jenkins-plugin/pipeline-model-definition: Jenkins Pipeline Declarative Plugin Allows Restart of Builds with Unapproved Jenkinsfile

A flaw was found in Jenkins Pipeline: Declarative Plugin pipeline-model-definition. This vulnerability allows attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer approved via insufficient script approval checks...

jenkins-plugin/workflow-cps: Lack of Approval Check for Rebuilt Jenkins Pipelines

A flaw was found in the Jenkins Pipeline: Groovy Plugin jenkins-plugin/workflow-cps. This vulnerability allows attackers with Item/Build permission to rebuild a previous build whose main Jenkinsfile script is no longer approved, bypassing script approval checks via the rebuild action...

jenkins-plugin/workflow-cps: Lack of Approval Check for Rebuilt Jenkins Pipelines

A flaw was found in the Jenkins Pipeline: Groovy Plugin jenkins-plugin/workflow-cps. This vulnerability allows attackers with Item/Build permission to rebuild a previous build whose main Jenkinsfile script is no longer approved, bypassing script approval checks via the rebuild action...

jenkins-plugin/pipeline-model-definition: Jenkins Pipeline Declarative Plugin Allows Restart of Builds with Unapproved Jenkinsfile

A flaw was found in Jenkins Pipeline: Declarative Plugin pipeline-model-definition. This vulnerability allows attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer approved via insufficient script approval checks...

jenkins-plugin/pipeline-model-definition: Jenkins Pipeline Declarative Plugin Allows Restart of Builds with Unapproved Jenkinsfile

A flaw was found in Jenkins Pipeline: Declarative Plugin pipeline-model-definition. This vulnerability allows attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer approved via insufficient script approval checks...

jenkins-plugin/pipeline-model-definition: Jenkins Pipeline Declarative Plugin Allows Restart of Builds with Unapproved Jenkinsfile

A flaw was found in Jenkins Pipeline: Declarative Plugin pipeline-model-definition. This vulnerability allows attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer approved via insufficient script approval checks...

jenkins-plugin/workflow-cps: Lack of Approval Check for Rebuilt Jenkins Pipelines

A flaw was found in the Jenkins Pipeline: Groovy Plugin jenkins-plugin/workflow-cps. This vulnerability allows attackers with Item/Build permission to rebuild a previous build whose main Jenkinsfile script is no longer approved, bypassing script approval checks via the rebuild action...

jenkins-plugin/workflow-cps: Lack of Approval Check for Rebuilt Jenkins Pipelines

A flaw was found in the Jenkins Pipeline: Groovy Plugin jenkins-plugin/workflow-cps. This vulnerability allows attackers with Item/Build permission to rebuild a previous build whose main Jenkinsfile script is no longer approved, bypassing script approval checks via the rebuild action...

jenkins-plugin/pipeline-model-definition: Jenkins Pipeline Declarative Plugin Allows Restart of Builds with Unapproved Jenkinsfile

A flaw was found in Jenkins Pipeline: Declarative Plugin pipeline-model-definition. This vulnerability allows attackers with Item/Build permission to restart a previous build whose Jenkinsfile script is no longer approved via insufficient script approval checks...