1612 matches found
CVE-2022-30946: Cross-Site Request Forgery (CSRF)
A cross-site request forgery CSRF vulnerability in Jenkins Script Security Plugin 1158.v7c1b73a69a08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver...
PT-2022-20400 · Jenkins · Jenkins Script Security Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Script Security Plugin versions 1158.v7c1b 73a 69a 08 and earlier Description: A cross-site request forgery CSRF issue allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver. This occurs because the...
Jenkins Script Security Plugin Remote Code Execution (CVE-2019-1003029)
A remote code execution vulnerability exists in Jenkins Script Security Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
GHSA-R9JF-HF9X-7HRV Exposure of Sensitive Information to an Unauthorized Actor Jenkins Script Security Plugin
In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new File objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type...
Exposure of Sensitive Information to an Unauthorized Actor Jenkins Script Security Plugin
In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new File objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type...
aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +240 more potentially affected by CVE-2017-1000505 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.34)
org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2017-1000505 Source advisory: OSV:GHSA-R9JF-HF9X-7HRV...
aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +240 more potentially affected by CVE-2017-1000505 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.34)
org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2017-1000505 Source advisory: GHSA-R9JF-HF9X-7HRV...
Improper Privilege Management in Jenkins
A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy...
Jenkins Script Security and Pipeline Groovy Plugins Sandbox Bypass
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permissio...
aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +245 more potentially affected by CVE-2018-1000865 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.46)
org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2018-1000865 Source advisory: OSV:GHSA-P4P5-3V2J-W5RV...
aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +245 more potentially affected by CVE-2018-1000866 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.46)
org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2018-1000866 Source advisory: GHSA-GQHM-4H93-RRHG...
aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +245 more potentially affected by CVE-2018-1000865 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.46)
org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2018-1000865 Source advisory: GHSA-P4P5-3V2J-W5RV...
aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +245 more potentially affected by CVE-2018-1000866 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.46)
org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2018-1000866 Source advisory: OSV:GHSA-GQHM-4H93-RRHG...
GHSA-P4P5-3V2J-W5RV Improper Privilege Management in Jenkins
A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy...
aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +236 more potentially affected by CVE-2017-1000107 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.30)
org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2017-1000107 Source advisory: OSV:GHSA-H7RX-R733-7X7R...
GHSA-H7RX-R733-7X7R Sandbox bypass in Jenkins Script Security Plugin sandbox bypass
Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection...
aendter.jenkins.plugins:filesystem-list-parameter-plugin (0.0.6), br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1) +236 more potentially affected by CVE-2017-1000107 via org.jenkins-ci.plugins:script-security (>=1.4, <=1.30)
org.jenkins-ci.plugins:script-security MAVEN version =1.4, =1.0.5.0, =0.2, =1.9.2-beta, =1.29, =1.28.0, =2.37.0, =1.7.2, =1.4.2, =0.0.1, =1.2.5, =1.0, =8.0.12, =8.0.14 and more Source cves: CVE-2017-1000107 Source advisory: GHSA-H7RX-R733-7X7R...
Sandbox bypass in Jenkins Script Security Plugin sandbox bypass
Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection...
Unsafe methods in the default list of approved signatures in Jenkins Script Security Plugin
The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAtObject, String, Object; DefaultGroovyMethods.getAtObject, String. These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild'rawBuild' rather than...
GHSA-M68X-CC2F-GR5H Unsafe methods in the default list of approved signatures in Jenkins Script Security Plugin
The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAtObject, String, Object; DefaultGroovyMethods.getAtObject, String. These allowed circumventing many of the access restrictions implemented in the script sandbox by using e.g. currentBuild'rawBuild' rather than...