Lucene search

Veracode Vulnerability DatabaseVERACODE:46802

HistoryMay 08, 2024 - 6:26 a.m.

Arbitrary Code Execution

2024-05-0806:26:13

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

arbitrary code execution

jenkins-ci

script-security

vulnerability

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.7%

JSON

org.jenkins-ci.plugins:script-security is vulnerable to Arbitrary Code Execution. The vulnerability is due to crafted constructor bodies that invoke other constructors which can then be used to construct any subclassable type via implicit casts, which bypasses the sandbox protection, resulting in Arbitrary Code Execution.

CPENameOperatorVersion
script security pluginle1335.vf07d9ce377a_e
script security pluginle1335.vf07d9ce377a_e

CPE	Name	Operator	Version
	script security plugin	le	1335.vf07d9ce377a_e
	script security plugin	le	1335.vf07d9ce377a_e

References

www.openwall.com/lists/oss-security/2024/05/02/3

github.com/jenkinsci/script-security-plugin/releases/tag/1336.vf33a_a_9863911

www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341